sibujs 4.6.0 → 4.8.0

package/dist/ssr.d.cts

@@ -1,10 +1,40 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-Bli9XRW5.cjs';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-C8hgIAw7.cjs';
+import { C as Component } from './types-CJFViL6Q.cjs';
 
 interface HeadProps {
     title?: string | (() => string);
     meta?: Record<string, string | (() => string)>[];
+    /**
+     * `<link>` elements to add to `<head>`.
+     *
+     * TRUST BOUNDARY for stylesheets: `{ rel: "stylesheet", href }` is the
+     * framework's explicit API for a stylesheet whose URL is a runtime value.
+     * The generic writers refuse to let a runtime `href` become an applied
+     * stylesheet at all (see `utils/elementPolicy.ts`), because a well-formed
+     * URL is not trusted CSS. Naming it here is the trust decision: first-party
+     * or pinned URLs only, and a CSP `style-src` as the second layer.
+     */
     link?: Record<string, string>[];
+    /**
+     * External scripts to add to `<head>`.
+     *
+     * TRUST BOUNDARY: this is the framework's explicit API for loading a script
+     * whose URL is a runtime value, and naming it here IS the trust decision —
+     * the URL passes the scheme allowlist, but an allowed `https:` URL is still a
+     * program that runs with the page's full authority. Pass only URLs you
+     * control or pin (a first-party path, a CDN URL with `integrity`). The
+     * generic writers refuse to let a runtime value choose a `<script>` source
+     * at all; see `docs/architecture/attribute-security.md` § Trust model.
+     */
     script?: Record<string, string>[];
+    /**
+     * The document `<base>`.
+     *
+     * TRUST BOUNDARY: `href` passes the scheme allowlist, but an allowed `https:`
+     * base still re-homes every relative URL on the page — relative `<script
+     * src>`, stylesheets, form actions and `fetch("/api")` alike. Treat it like a
+     * script URL: first-party values only.
+     */
     base?: {
         href?: string;
         target?: string;
@@ -94,6 +124,10 @@ interface UseWorkerFnReturn<TArgs extends unknown[], TResult> {
  * The function must be self-contained -- it cannot reference variables
  * from the outer scope. Arguments are serialized via postMessage.
  *
+ * **Trust boundary:** the function's source is evaluated in a `blob:` worker,
+ * which is equivalent to `eval()`. Only a function object is accepted — never
+ * a string, and never a function built from untrusted input.
+ *
  * @param fn A pure function to execute in a worker thread.
  * @returns An object with run, loading, and terminate.
  */
@@ -108,6 +142,9 @@ interface WorkerPool<TInput, TOutput> {
  * Tasks are distributed across workers using round-robin scheduling.
  * Each worker is created from the same inline function.
  *
+ * **Trust boundary:** as with `worker()`, the function's source is evaluated in
+ * a `blob:` worker. Only a function object is accepted, never a string.
+ *
  * @param workerFn The function body to run inside each worker.
  * @param poolSize Number of workers in the pool (defaults to navigator.hardwareConcurrency or 4).
  * @returns An object with execute and terminate.
@@ -362,9 +399,13 @@ interface LoadRemoteModuleOptions {
     unsafelyAllowAnyOrigin?: boolean;
 }
 declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
-type Component = () => HTMLElement;
-type RemoteLoader = () => Promise<{
-    default: Component;
+/**
+ * Loads the remote module whose `default` export is the component. Its root may
+ * be any `Element` — an SVG root included — using the public `Component` type
+ * rather than a private `() => HTMLElement` that forced a cast.
+ */
+type RemoteLoader<R extends Element = HTMLElement> = () => Promise<{
+    default: Component<void, R>;
 }>;
 /**
  * Register a remote component that loads on demand.
@@ -392,7 +433,7 @@ type RemoteLoader = () => Promise<{
  * document.body.appendChild(RemoteHeader());
  * ```
  */
-declare function defineRemoteComponent(name: string, loader: RemoteLoader): Component;
+declare function defineRemoteComponent<R extends Element = HTMLElement>(name: string, loader: RemoteLoader<R>): Component<void, R | HTMLElement>;
 /**
  * Create a shared state scope that enables communication between independent
  * micro-frontend instances.
@@ -430,6 +471,15 @@ interface ServiceWorkerState {
 /**
  * serviceWorker registers and manages a service worker.
  *
+ * TRUST BOUNDARY: `scriptUrl` is CODE. A service worker runs with authority
+ * over every page in its scope and persists across reloads, so this is the
+ * strongest code-loading primitive in the framework. The browser enforces
+ * same-origin, a secure context and a JavaScript MIME type — it does NOT
+ * protect against a same-origin URL that serves attacker-influenced content
+ * (a JSONP endpoint, an upload directory). Pass only a literal path to a worker
+ * script you ship; never a value derived from the URL, storage or an API
+ * response.
+ *
  * LIFECYCLE CONTRACT
  * ------------------
  * Registration is asynchronous and `unregister()` can be called at any point

package/dist/ssr.d.ts

@@ -1,10 +1,40 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-Bli9XRW5.js';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-C8hgIAw7.js';
+import { C as Component } from './types-CJFViL6Q.js';
 
 interface HeadProps {
     title?: string | (() => string);
     meta?: Record<string, string | (() => string)>[];
+    /**
+     * `<link>` elements to add to `<head>`.
+     *
+     * TRUST BOUNDARY for stylesheets: `{ rel: "stylesheet", href }` is the
+     * framework's explicit API for a stylesheet whose URL is a runtime value.
+     * The generic writers refuse to let a runtime `href` become an applied
+     * stylesheet at all (see `utils/elementPolicy.ts`), because a well-formed
+     * URL is not trusted CSS. Naming it here is the trust decision: first-party
+     * or pinned URLs only, and a CSP `style-src` as the second layer.
+     */
     link?: Record<string, string>[];
+    /**
+     * External scripts to add to `<head>`.
+     *
+     * TRUST BOUNDARY: this is the framework's explicit API for loading a script
+     * whose URL is a runtime value, and naming it here IS the trust decision —
+     * the URL passes the scheme allowlist, but an allowed `https:` URL is still a
+     * program that runs with the page's full authority. Pass only URLs you
+     * control or pin (a first-party path, a CDN URL with `integrity`). The
+     * generic writers refuse to let a runtime value choose a `<script>` source
+     * at all; see `docs/architecture/attribute-security.md` § Trust model.
+     */
     script?: Record<string, string>[];
+    /**
+     * The document `<base>`.
+     *
+     * TRUST BOUNDARY: `href` passes the scheme allowlist, but an allowed `https:`
+     * base still re-homes every relative URL on the page — relative `<script
+     * src>`, stylesheets, form actions and `fetch("/api")` alike. Treat it like a
+     * script URL: first-party values only.
+     */
     base?: {
         href?: string;
         target?: string;
@@ -94,6 +124,10 @@ interface UseWorkerFnReturn<TArgs extends unknown[], TResult> {
  * The function must be self-contained -- it cannot reference variables
  * from the outer scope. Arguments are serialized via postMessage.
  *
+ * **Trust boundary:** the function's source is evaluated in a `blob:` worker,
+ * which is equivalent to `eval()`. Only a function object is accepted — never
+ * a string, and never a function built from untrusted input.
+ *
  * @param fn A pure function to execute in a worker thread.
  * @returns An object with run, loading, and terminate.
  */
@@ -108,6 +142,9 @@ interface WorkerPool<TInput, TOutput> {
  * Tasks are distributed across workers using round-robin scheduling.
  * Each worker is created from the same inline function.
  *
+ * **Trust boundary:** as with `worker()`, the function's source is evaluated in
+ * a `blob:` worker. Only a function object is accepted, never a string.
+ *
  * @param workerFn The function body to run inside each worker.
  * @param poolSize Number of workers in the pool (defaults to navigator.hardwareConcurrency or 4).
  * @returns An object with execute and terminate.
@@ -362,9 +399,13 @@ interface LoadRemoteModuleOptions {
     unsafelyAllowAnyOrigin?: boolean;
 }
 declare function loadRemoteModule(url: string, optionsOrAllowedOrigins?: string[] | LoadRemoteModuleOptions): Promise<unknown>;
-type Component = () => HTMLElement;
-type RemoteLoader = () => Promise<{
-    default: Component;
+/**
+ * Loads the remote module whose `default` export is the component. Its root may
+ * be any `Element` — an SVG root included — using the public `Component` type
+ * rather than a private `() => HTMLElement` that forced a cast.
+ */
+type RemoteLoader<R extends Element = HTMLElement> = () => Promise<{
+    default: Component<void, R>;
 }>;
 /**
  * Register a remote component that loads on demand.
@@ -392,7 +433,7 @@ type RemoteLoader = () => Promise<{
  * document.body.appendChild(RemoteHeader());
  * ```
  */
-declare function defineRemoteComponent(name: string, loader: RemoteLoader): Component;
+declare function defineRemoteComponent<R extends Element = HTMLElement>(name: string, loader: RemoteLoader<R>): Component<void, R | HTMLElement>;
 /**
  * Create a shared state scope that enables communication between independent
  * micro-frontend instances.
@@ -430,6 +471,15 @@ interface ServiceWorkerState {
 /**
  * serviceWorker registers and manages a service worker.
  *
+ * TRUST BOUNDARY: `scriptUrl` is CODE. A service worker runs with authority
+ * over every page in its scope and persists across reloads, so this is the
+ * strongest code-loading primitive in the framework. The browser enforces
+ * same-origin, a secure context and a JavaScript MIME type — it does NOT
+ * protect against a same-origin URL that serves attacker-influenced content
+ * (a JSONP endpoint, an upload directory). Pass only a literal path to a worker
+ * script you ship; never a value derived from the URL, storage or an API
+ * response.
+ *
  * LIFECYCLE CONTRACT
  * ------------------
  * Registration is asynchronous and `unregister()` can be called at any point

package/dist/ssr.js

@@ -23,9 +23,9 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-ORMZXBKQ.js";
+} from "./chunk-JUTFX2RM.js";
 import "./chunk-52XFPGSN.js";
-import "./chunk-JSXPZCET.js";
+import "./chunk-Q5J2LVKH.js";
 import {
   collectStream,
   deserializeState,
@@ -45,15 +45,17 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-HURREPU2.js";
-import "./chunk-VVWPJ543.js";
-import "./chunk-47M47FOM.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-VWT3VXPL.js";
+import "./chunk-O6TRVMJI.js";
+import "./chunk-3ACAAQIN.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-XC4MEKGA.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-D33YTSX5.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   Head,

package/dist/{tagFactory-DFstCLQV.d.cts → tagFactory-8qL9LCIx.d.cts}

@@ -1,4 +1,5 @@
 import { A as Accessor } from './signal-EotCj4hS.cjs';
+import { N as NodeChildren } from './types-CJFViL6Q.cjs';
 
 /**
  * derived creates a derived reactive signal whose value updates when dependencies change.
@@ -60,31 +61,60 @@ type DerivedAccessor<T> = Accessor<T> & {
     dispose: () => void;
 };
 
+declare const SVG_NS = "http://www.w3.org/2000/svg";
 /**
- * Canonical disposer/teardown signature used across the framework.
- *
- * Returned by `effect()`, `track()`, widget `bind()` methods, and other
- * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
- * twice should be a no-op rather than an error.
+ * A style declaration map: camelCase or kebab-case property names to values.
+ * Each value may be a getter, which binds that one property reactively.
  */
-type Dispose = () => void;
-type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
-type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
-
-declare const SVG_NS = "http://www.w3.org/2000/svg";
-interface TagProps {
-    id?: string;
-    class?: string | (() => string) | Record<string, boolean | (() => boolean)>;
-    style?: Record<string, string | number | (() => string | number)> | string | (() => string);
+type StyleMap = Record<string, string | number | (() => string | number)>;
+/**
+ * A style map produced by a whole-`style` getter. The getter already runs
+ * reactively, so its values are plain; a `null` / `undefined` value leaves the
+ * property unset (and removes it if an earlier run set it).
+ */
+type StyleObject = Record<string, string | number | null | undefined>;
+/**
+ * Listeners for the `on` prop. Known DOM event names get their specific event
+ * type from the DOM lib (`keydown` → `KeyboardEvent`, `click` → the lib's
+ * `MouseEvent` / `PointerEvent`), so a handler may declare it without a cast;
+ * any other name (custom events) receives an `Event`. That fallback is
+ * method-typed, so a handler declaring a narrower event
+ * (`(e: CustomEvent<Detail>) => …`) is still accepted for a custom name.
+ */
+type TagEventHandlers = {
+    [K in keyof HTMLElementEventMap]?: (ev: HTMLElementEventMap[K]) => void;
+} & {
+    [event: string]: {
+        handle(ev: Event): void;
+    }["handle"] | undefined;
+};
+/**
+ * Props accepted by a tag factory. `El` is the element the factory creates;
+ * it types `onElement`.
+ */
+interface TagProps<El extends Element = HTMLElement> {
+    id?: string | (() => string);
+    class?: string | (() => string | null | undefined | false) | Record<string, boolean | (() => boolean)>;
+    style?: StyleMap | string | (() => string | StyleObject);
+    /**
+     * Receives the created element. Accepts what `ref()` returns under `strict`
+     * (`ref<HTMLInputElement>()` is a `Ref<HTMLInputElement | undefined>`) as
+     * well as a `{ current: Element | null }` box.
+     */
     ref?: {
-        current: Element | null;
+        current: Element | null | undefined;
     };
     nodes?: NodeChildren;
-    on?: Record<string, (ev: Event) => void>;
+    on?: TagEventHandlers;
     /** Called with the element after creation — useful for imperative bindings */
-    onElement?: (el: HTMLElement) => void;
+    onElement?(el: El): void;
     [attr: string]: unknown;
 }
+/**
+ * A tag factory: builds one `El` per call. See {@link tagFactory} for the
+ * accepted calling conventions.
+ */
+type TagFunction<El extends Element, Props extends TagProps<El> = TagProps<El>> = (first?: Props | NodeChildren, second?: NodeChildren) => El;
 /**
  * Factory for creating HTML or SVG elements with reactive props and nodes.
  *
@@ -111,7 +141,16 @@ interface TagProps {
  *   ])
  *
  * `children` overrides `props.nodes` when both are present.
+ *
+ * The returned factory is typed by the tag: `tagFactory("div")` builds
+ * `HTMLDivElement`s, `tagFactory("circle", SVG_NS)` builds `SVGCircleElement`s.
+ * A tag name TypeScript does not know builds `HTMLElement`s (which is what
+ * `document.createElement` returns for it), or `Element`s in another namespace.
  */
-declare const tagFactory: (tag: string, ns?: string) => (first?: TagProps | NodeChildren, second?: NodeChildren) => Element;
+declare function tagFactory<K extends keyof HTMLElementTagNameMap>(tag: K, ns?: undefined): TagFunction<HTMLElementTagNameMap[K]>;
+declare function tagFactory<K extends keyof SVGElementTagNameMap>(tag: K, ns: typeof SVG_NS): TagFunction<SVGElementTagNameMap[K]>;
+declare function tagFactory(tag: string, ns?: undefined): TagFunction<HTMLElement>;
+declare function tagFactory(tag: string, ns: typeof SVG_NS): TagFunction<SVGElement>;
+declare function tagFactory(tag: string, ns?: string): TagFunction<Element>;
 
-export { type DerivedAccessor as D, type NodeChild as N, SVG_NS as S, type TagProps as T, type NodeChildren as a, type Dispose as b, derived as d, tagFactory as t };
+export { type DerivedAccessor as D, SVG_NS as S, type TagProps as T, type TagFunction as a, type StyleMap as b, type StyleObject as c, type TagEventHandlers as d, derived as e, tagFactory as t };

package/dist/{tagFactory-DkaNVUNV.d.ts → tagFactory-BL2fymez.d.ts}

@@ -1,4 +1,5 @@
 import { A as Accessor } from './signal-EotCj4hS.js';
+import { N as NodeChildren } from './types-CJFViL6Q.js';
 
 /**
  * derived creates a derived reactive signal whose value updates when dependencies change.
@@ -60,31 +61,60 @@ type DerivedAccessor<T> = Accessor<T> & {
     dispose: () => void;
 };
 
+declare const SVG_NS = "http://www.w3.org/2000/svg";
 /**
- * Canonical disposer/teardown signature used across the framework.
- *
- * Returned by `effect()`, `track()`, widget `bind()` methods, and other
- * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
- * twice should be a no-op rather than an error.
+ * A style declaration map: camelCase or kebab-case property names to values.
+ * Each value may be a getter, which binds that one property reactively.
  */
-type Dispose = () => void;
-type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
-type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
-
-declare const SVG_NS = "http://www.w3.org/2000/svg";
-interface TagProps {
-    id?: string;
-    class?: string | (() => string) | Record<string, boolean | (() => boolean)>;
-    style?: Record<string, string | number | (() => string | number)> | string | (() => string);
+type StyleMap = Record<string, string | number | (() => string | number)>;
+/**
+ * A style map produced by a whole-`style` getter. The getter already runs
+ * reactively, so its values are plain; a `null` / `undefined` value leaves the
+ * property unset (and removes it if an earlier run set it).
+ */
+type StyleObject = Record<string, string | number | null | undefined>;
+/**
+ * Listeners for the `on` prop. Known DOM event names get their specific event
+ * type from the DOM lib (`keydown` → `KeyboardEvent`, `click` → the lib's
+ * `MouseEvent` / `PointerEvent`), so a handler may declare it without a cast;
+ * any other name (custom events) receives an `Event`. That fallback is
+ * method-typed, so a handler declaring a narrower event
+ * (`(e: CustomEvent<Detail>) => …`) is still accepted for a custom name.
+ */
+type TagEventHandlers = {
+    [K in keyof HTMLElementEventMap]?: (ev: HTMLElementEventMap[K]) => void;
+} & {
+    [event: string]: {
+        handle(ev: Event): void;
+    }["handle"] | undefined;
+};
+/**
+ * Props accepted by a tag factory. `El` is the element the factory creates;
+ * it types `onElement`.
+ */
+interface TagProps<El extends Element = HTMLElement> {
+    id?: string | (() => string);
+    class?: string | (() => string | null | undefined | false) | Record<string, boolean | (() => boolean)>;
+    style?: StyleMap | string | (() => string | StyleObject);
+    /**
+     * Receives the created element. Accepts what `ref()` returns under `strict`
+     * (`ref<HTMLInputElement>()` is a `Ref<HTMLInputElement | undefined>`) as
+     * well as a `{ current: Element | null }` box.
+     */
     ref?: {
-        current: Element | null;
+        current: Element | null | undefined;
     };
     nodes?: NodeChildren;
-    on?: Record<string, (ev: Event) => void>;
+    on?: TagEventHandlers;
     /** Called with the element after creation — useful for imperative bindings */
-    onElement?: (el: HTMLElement) => void;
+    onElement?(el: El): void;
     [attr: string]: unknown;
 }
+/**
+ * A tag factory: builds one `El` per call. See {@link tagFactory} for the
+ * accepted calling conventions.
+ */
+type TagFunction<El extends Element, Props extends TagProps<El> = TagProps<El>> = (first?: Props | NodeChildren, second?: NodeChildren) => El;
 /**
  * Factory for creating HTML or SVG elements with reactive props and nodes.
  *
@@ -111,7 +141,16 @@ interface TagProps {
  *   ])
  *
  * `children` overrides `props.nodes` when both are present.
+ *
+ * The returned factory is typed by the tag: `tagFactory("div")` builds
+ * `HTMLDivElement`s, `tagFactory("circle", SVG_NS)` builds `SVGCircleElement`s.
+ * A tag name TypeScript does not know builds `HTMLElement`s (which is what
+ * `document.createElement` returns for it), or `Element`s in another namespace.
  */
-declare const tagFactory: (tag: string, ns?: string) => (first?: TagProps | NodeChildren, second?: NodeChildren) => Element;
+declare function tagFactory<K extends keyof HTMLElementTagNameMap>(tag: K, ns?: undefined): TagFunction<HTMLElementTagNameMap[K]>;
+declare function tagFactory<K extends keyof SVGElementTagNameMap>(tag: K, ns: typeof SVG_NS): TagFunction<SVGElementTagNameMap[K]>;
+declare function tagFactory(tag: string, ns?: undefined): TagFunction<HTMLElement>;
+declare function tagFactory(tag: string, ns: typeof SVG_NS): TagFunction<SVGElement>;
+declare function tagFactory(tag: string, ns?: string): TagFunction<Element>;
 
-export { type DerivedAccessor as D, type NodeChild as N, SVG_NS as S, type TagProps as T, type NodeChildren as a, type Dispose as b, derived as d, tagFactory as t };
+export { type DerivedAccessor as D, SVG_NS as S, type TagProps as T, type TagFunction as a, type StyleMap as b, type StyleObject as c, type TagEventHandlers as d, derived as e, tagFactory as t };

package/dist/testing.cjs

@@ -754,7 +754,7 @@ function forEachSubscriber(signal, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.6.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -810,6 +810,14 @@ var getSubscriberCount2 = API.getSubscriberCount;
 var getSubscriberDeps2 = API.getSubscriberDeps;
 var forEachSubscriber2 = API.forEachSubscriber;
 
+// src/core/devtoolsHook.ts
+function emitDevtools(hook, event, payload) {
+  try {
+    hook.emit(event, payload);
+  } catch {
+  }
+}
+
 // src/core/ssr-context.ts
 var SSR_KEY = /* @__PURE__ */ Symbol.for("sibujs.ssr.v1");
 function detectSSRShared() {
@@ -964,12 +972,17 @@ function effect(effectFn, options) {
   try {
     retrack2(ctx.bodyFn, ctx.subscriber);
     if (ctx.rerunPending) drainReruns(ctx);
+  } catch (err) {
+    ctx.disposed = true;
+    if (ctx.userCleanups.length > 0) flushUserCleanups(ctx);
+    cleanup2(ctx.subscriber);
+    throw err;
   } finally {
     ctx.running = false;
     ctx.rerunPending = false;
   }
   const hook = _g.__SIBU_DEVTOOLS_GLOBAL_HOOK__;
-  if (hook) hook.emit("effect:create", { effectFn });
+  if (hook) emitDevtools(hook, "effect:create", { effectFn });
   return () => disposeEffect(ctx);
 }
 
@@ -1150,8 +1163,8 @@ function enableListenerTracking() {
     if (opts?.signal) {
       const signal = opts.signal;
       const onAbort = () => drop(this, type2, entry);
-      add.call(signal, "abort", onAbort, { once: true });
-      releases.push(() => remove.call(signal, "abort", onAbort));
+      signal.addEventListener("abort", onAbort, { once: true });
+      releases.push(() => signal.removeEventListener("abort", onAbort));
     }
     if (releases.length > 0) {
       entry.release = () => {

package/dist/testing.js

@@ -3,9 +3,9 @@ import {
 } from "./chunk-7ZHH77QA.js";
 import {
   effect
-} from "./chunk-XC4MEKGA.js";
+} from "./chunk-V3LHZSU5.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-5Q4R7HCL.js";
+import "./chunk-TQQUN4WR.js";
 import {
   dispose,
   replaceChildrenSafely,
@@ -189,8 +189,8 @@ function enableListenerTracking() {
     if (opts?.signal) {
       const signal = opts.signal;
       const onAbort = () => drop(this, type2, entry);
-      add.call(signal, "abort", onAbort, { once: true });
-      releases.push(() => remove.call(signal, "abort", onAbort));
+      signal.addEventListener("abort", onAbort, { once: true });
+      releases.push(() => signal.removeEventListener("abort", onAbort));
     }
     if (releases.length > 0) {
       entry.release = () => {

package/dist/types-CJFViL6Q.d.cts

@@ -0,0 +1,26 @@
+/**
+ * Canonical disposer/teardown signature used across the framework.
+ *
+ * Returned by `effect()`, `track()`, widget `bind()` methods, and other
+ * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
+ * twice should be a no-op rather than an error.
+ */
+type Dispose = () => void;
+/**
+ * A component: a function from its props to the DOM node it renders.
+ *
+ * `P` defaults to `void`, so a prop-less component is written and called
+ * without arguments (`const App: Component = () => div("hi")`, then `App()`).
+ * `R` is the root the component returns. It defaults to `Element`, so HTML and
+ * SVG roots both fit; narrow it (`Component<Props, HTMLDivElement>`) to expose
+ * the specific root type to callers.
+ *
+ * Every framework API that takes a component (`mount`, `lazy`, `Suspense`,
+ * `Portal`, `registerComponent`, `DynamicComponent`, the HOC helpers) accepts
+ * a `Component`, and every tag factory's result fits its return type.
+ */
+type Component<P = void, R extends Node = Element> = (props: P) => R;
+type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
+type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
+
+export type { Component as C, Dispose as D, NodeChildren as N, NodeChild as a };

package/dist/types-CJFViL6Q.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Canonical disposer/teardown signature used across the framework.
+ *
+ * Returned by `effect()`, `track()`, widget `bind()` methods, and other
+ * subscription/lifecycle helpers. All disposers MUST be idempotent — calling
+ * twice should be a no-op rather than an error.
+ */
+type Dispose = () => void;
+/**
+ * A component: a function from its props to the DOM node it renders.
+ *
+ * `P` defaults to `void`, so a prop-less component is written and called
+ * without arguments (`const App: Component = () => div("hi")`, then `App()`).
+ * `R` is the root the component returns. It defaults to `Element`, so HTML and
+ * SVG roots both fit; narrow it (`Component<Props, HTMLDivElement>`) to expose
+ * the specific root type to callers.
+ *
+ * Every framework API that takes a component (`mount`, `lazy`, `Suspense`,
+ * `Portal`, `registerComponent`, `DynamicComponent`, the HOC helpers) accepts
+ * a `Component`, and every tag factory's result fits its return type.
+ */
+type Component<P = void, R extends Node = Element> = (props: P) => R;
+type NodeChild = Node | Element | Text | Comment | string | number | boolean | (() => NodeChild) | null | undefined;
+type NodeChildren = NodeChild | NodeChild[] | NodeChild[][] | (() => NodeChild | NodeChild[]);
+
+export type { Component as C, Dispose as D, NodeChildren as N, NodeChild as a };