sibujs 4.7.0 → 4.8.0

package/dist/index.d.cts

@@ -4,7 +4,7 @@ import { T as TagProps, a as TagFunction, D as DerivedAccessor } from './tagFact
 export { S as SVG_NS, b as StyleMap, c as StyleObject, d as TagEventHandlers, e as derived, t as tagFactory } from './tagFactory-8qL9LCIx.cjs';
 import { A as Accessor } from './signal-EotCj4hS.cjs';
 export { D as DisposableAccessor, E as ExternalSource, S as SignalOptions, e as external, s as signal } from './signal-EotCj4hS.cjs';
-export { T as TrustedHTML, t as trustHTML } from './ssr-Bli9XRW5.cjs';
+export { T as TrustedHTML, t as trustHTML } from './ssr-C8hgIAw7.cjs';
 import { R as ReactiveSignal } from './signal-BnWpq6WB.cjs';
 
 interface ErrorBoundaryOptions {
@@ -741,6 +741,25 @@ declare function Fragment(nodes: NodeChildren[]): DocumentFragment;
  * string, and not a virtual node.
  */
 declare function html(strings: TemplateStringsArray, ...values: unknown[]): Element;
+/**
+ * Render a template the build-time compiler has ALREADY PARSED. Internal: the
+ * entry point compiled `html` templates call, not an API for applications.
+ *
+ * The compiler emits most templates as straight-line DOM code. Some it cannot
+ * reproduce exactly — an expression on `value` / `checked`, a top-level
+ * `${expr}`, a `<meta>`, a static `srcdoc` — and those used to be left to this
+ * module's parser at runtime. Passing the tree the compiler's line-for-line
+ * port of that parser produced to the runtime's own executor compiles them too,
+ * with output identical to the runtime BY CONSTRUCTION: it is the runtime.
+ *
+ * TRUST BOUNDARY: `tree` is template SOURCE. Its tag names and static
+ * attributes are treated exactly like text typed into an `html` template, so it
+ * must only ever be a constant the compiler emitted — never data built at
+ * runtime. Interpolated `values` keep the runtime policy.
+ *
+ * @internal
+ */
+declare function __renderParsedTemplate(tree: readonly unknown[], values: unknown[]): Element;
 
 type reactive<T> = T | (() => T);
 interface AnchorProps extends TagProps<HTMLAnchorElement> {
@@ -979,6 +998,13 @@ declare const template: TagFunction<HTMLTemplateElement, TagProps<HTMLTemplateEl
 declare const base: TagFunction<HTMLBaseElement, TagProps<HTMLBaseElement>>;
 declare const link: TagFunction<HTMLLinkElement, TagProps<HTMLLinkElement>>;
 declare const meta: TagFunction<HTMLMetaElement, TagProps<HTMLMetaElement>>;
+/**
+ * `<style>`. Its text is STYLESHEET SOURCE, applied unsanitized exactly like a
+ * stylesheet shipped with the application — a trust boundary, since a tag
+ * factory cannot tell a literal from runtime data. For CSS that comes from
+ * runtime data use `scopedStyle()` (sanitized stylesheet text) or `style` props
+ * (sanitized per declaration).
+ */
 declare const style: TagFunction<HTMLStyleElement, TagProps<HTMLStyleElement>>;
 declare const circle: TagFunction<SVGCircleElement, TagProps<SVGCircleElement>>;
 declare const ellipse: TagFunction<SVGEllipseElement, TagProps<SVGEllipseElement>>;
@@ -2221,4 +2247,4 @@ declare const untracked: ReactiveApi["untracked"];
 declare const retrack: ReactiveApi["retrack"];
 declare const setMaxDrainIterations: ReactiveApi["setMaxDrainIterations"];
 
-export { Accessor, type ActionFn, type AnchorProps, type ArrayActions, type AsyncDerivedContext, type AsyncDerivedState, type AudioProps, type ButtonProps, Component, type Context, DerivedAccessor, DynamicComponent, type EachBindings, type EachEventBindings, type EffectBody, type EffectOptions, type EnhanceContext, type EnhanceSetup, ErrorBoundary, type ErrorBoundaryOptions, type ErrorBoundaryProps, ErrorDisplay, type ErrorDisplayProps, type ErrorSeverity, type FormProps, Fragment, type ImgProps, type InputProps, type InputType, type IslandLoader, type IslandRegistration, type IslandStrategy, KeepAlive, type KeepAliveOptions, type LabelProps, type LazyIslandLoader, Loading, type LoadingProps, type LongPressOptions, MAX_DRAIN_TEARDOWNS, type MediaProps, type MountIslandsOptions, NodeChild, NodeChildren, type OnCleanup, type OptionProps, Portal, type Ref, type RuntimeErrorContext, type RuntimeErrorHandler, type RuntimeErrorPhase, type SSRStore, type SelectProps, type SlotFn, type Slots, type StoreActions, Suspense, type SuspenseProps, TagFunction, TagProps, type TextareaProps, type TypedTagFunction, type VideoProps, __resetIdCounter, a, abbr, action, address, area, array, article, aside, asyncDerived, audio, autoResize, b, base, batch, bdi, bdo, bindDynamic, blockquote, body, br, button, canvas, caption, catchError, catchErrorAsync, center, checkLeaks, circle, cite, clickOutside, clipPath, code, col, colgroup, context, copyOnClick, createId, customElement, data, datalist, dd, deepEqual, deepSignal, defer, defs, del, details, dfn, dialog, disableSSR, dispose, div, dl, dt, each, effect, ellipse, em, embed, enableSSR, enhance, enhanceAll, enqueueBatchedSignal, fieldset, figcaption, figure, font, footer, form, g, getAction, getRequestScopedCache, getRuntimeErrorHandler, getSSRStore, getSlot, h1, h2, h3, h4, h5, h6, head, header, hr, html, i, iframe, img, input, ins, isBatching, isSSR, kbd, label, lazy, lazyIsland, legend, li, line, linearGradient, link, longPress, main, map, mark, marker, marquee, mask, match, math, menu, meta, meter, mount, mountIslands, nav, nextTick, noscript, object, ol, on, onCleanup, onMount, onUnmount, optgroup, option, output, p, param, path, pattern, picture, polygon, polyline, portal, pre, progress, q, radialGradient, reactiveArray, rect, ref, registerAction, registerComponent, registerDisposer, registerIsland, replaceChildrenSafely, reportDrainRunaway, reportError, resolveComponent, retrack, rp, rt, ruby, runInSSRContext, s, samp, script, section, select, setGlobalErrorHandler, setMaxDrainIterations, setRuntimeErrorHandler, show, slot, small, source, span, stop, store, strict, strictEffect, strong, style, sub, summary, sup, svg, symbol, table, takePendingError, tbody, td, template, text, textarea, tfoot, th, thead, time, title, tr, track$1 as track, transition, trapFocus, tspan, u, ul, unregisterComponent, unregisterDisposer, unregisterIsland, untracked, use, var_, video, watch, when, withSSR, writable };
+export { Accessor, type ActionFn, type AnchorProps, type ArrayActions, type AsyncDerivedContext, type AsyncDerivedState, type AudioProps, type ButtonProps, Component, type Context, DerivedAccessor, DynamicComponent, type EachBindings, type EachEventBindings, type EffectBody, type EffectOptions, type EnhanceContext, type EnhanceSetup, ErrorBoundary, type ErrorBoundaryOptions, type ErrorBoundaryProps, ErrorDisplay, type ErrorDisplayProps, type ErrorSeverity, type FormProps, Fragment, type ImgProps, type InputProps, type InputType, type IslandLoader, type IslandRegistration, type IslandStrategy, KeepAlive, type KeepAliveOptions, type LabelProps, type LazyIslandLoader, Loading, type LoadingProps, type LongPressOptions, MAX_DRAIN_TEARDOWNS, type MediaProps, type MountIslandsOptions, NodeChild, NodeChildren, type OnCleanup, type OptionProps, Portal, type Ref, type RuntimeErrorContext, type RuntimeErrorHandler, type RuntimeErrorPhase, type SSRStore, type SelectProps, type SlotFn, type Slots, type StoreActions, Suspense, type SuspenseProps, TagFunction, TagProps, type TextareaProps, type TypedTagFunction, type VideoProps, __renderParsedTemplate, __resetIdCounter, a, abbr, action, address, area, array, article, aside, asyncDerived, audio, autoResize, b, base, batch, bdi, bdo, bindDynamic, blockquote, body, br, button, canvas, caption, catchError, catchErrorAsync, center, checkLeaks, circle, cite, clickOutside, clipPath, code, col, colgroup, context, copyOnClick, createId, customElement, data, datalist, dd, deepEqual, deepSignal, defer, defs, del, details, dfn, dialog, disableSSR, dispose, div, dl, dt, each, effect, ellipse, em, embed, enableSSR, enhance, enhanceAll, enqueueBatchedSignal, fieldset, figcaption, figure, font, footer, form, g, getAction, getRequestScopedCache, getRuntimeErrorHandler, getSSRStore, getSlot, h1, h2, h3, h4, h5, h6, head, header, hr, html, i, iframe, img, input, ins, isBatching, isSSR, kbd, label, lazy, lazyIsland, legend, li, line, linearGradient, link, longPress, main, map, mark, marker, marquee, mask, match, math, menu, meta, meter, mount, mountIslands, nav, nextTick, noscript, object, ol, on, onCleanup, onMount, onUnmount, optgroup, option, output, p, param, path, pattern, picture, polygon, polyline, portal, pre, progress, q, radialGradient, reactiveArray, rect, ref, registerAction, registerComponent, registerDisposer, registerIsland, replaceChildrenSafely, reportDrainRunaway, reportError, resolveComponent, retrack, rp, rt, ruby, runInSSRContext, s, samp, script, section, select, setGlobalErrorHandler, setMaxDrainIterations, setRuntimeErrorHandler, show, slot, small, source, span, stop, store, strict, strictEffect, strong, style, sub, summary, sup, svg, symbol, table, takePendingError, tbody, td, template, text, textarea, tfoot, th, thead, time, title, tr, track$1 as track, transition, trapFocus, tspan, u, ul, unregisterComponent, unregisterDisposer, unregisterIsland, untracked, use, var_, video, watch, when, withSSR, writable };

package/dist/index.d.ts

@@ -4,7 +4,7 @@ import { T as TagProps, a as TagFunction, D as DerivedAccessor } from './tagFact
 export { S as SVG_NS, b as StyleMap, c as StyleObject, d as TagEventHandlers, e as derived, t as tagFactory } from './tagFactory-BL2fymez.js';
 import { A as Accessor } from './signal-EotCj4hS.js';
 export { D as DisposableAccessor, E as ExternalSource, S as SignalOptions, e as external, s as signal } from './signal-EotCj4hS.js';
-export { T as TrustedHTML, t as trustHTML } from './ssr-Bli9XRW5.js';
+export { T as TrustedHTML, t as trustHTML } from './ssr-C8hgIAw7.js';
 import { R as ReactiveSignal } from './signal-BnWpq6WB.js';
 
 interface ErrorBoundaryOptions {
@@ -741,6 +741,25 @@ declare function Fragment(nodes: NodeChildren[]): DocumentFragment;
  * string, and not a virtual node.
  */
 declare function html(strings: TemplateStringsArray, ...values: unknown[]): Element;
+/**
+ * Render a template the build-time compiler has ALREADY PARSED. Internal: the
+ * entry point compiled `html` templates call, not an API for applications.
+ *
+ * The compiler emits most templates as straight-line DOM code. Some it cannot
+ * reproduce exactly — an expression on `value` / `checked`, a top-level
+ * `${expr}`, a `<meta>`, a static `srcdoc` — and those used to be left to this
+ * module's parser at runtime. Passing the tree the compiler's line-for-line
+ * port of that parser produced to the runtime's own executor compiles them too,
+ * with output identical to the runtime BY CONSTRUCTION: it is the runtime.
+ *
+ * TRUST BOUNDARY: `tree` is template SOURCE. Its tag names and static
+ * attributes are treated exactly like text typed into an `html` template, so it
+ * must only ever be a constant the compiler emitted — never data built at
+ * runtime. Interpolated `values` keep the runtime policy.
+ *
+ * @internal
+ */
+declare function __renderParsedTemplate(tree: readonly unknown[], values: unknown[]): Element;
 
 type reactive<T> = T | (() => T);
 interface AnchorProps extends TagProps<HTMLAnchorElement> {
@@ -979,6 +998,13 @@ declare const template: TagFunction<HTMLTemplateElement, TagProps<HTMLTemplateEl
 declare const base: TagFunction<HTMLBaseElement, TagProps<HTMLBaseElement>>;
 declare const link: TagFunction<HTMLLinkElement, TagProps<HTMLLinkElement>>;
 declare const meta: TagFunction<HTMLMetaElement, TagProps<HTMLMetaElement>>;
+/**
+ * `<style>`. Its text is STYLESHEET SOURCE, applied unsanitized exactly like a
+ * stylesheet shipped with the application — a trust boundary, since a tag
+ * factory cannot tell a literal from runtime data. For CSS that comes from
+ * runtime data use `scopedStyle()` (sanitized stylesheet text) or `style` props
+ * (sanitized per declaration).
+ */
 declare const style: TagFunction<HTMLStyleElement, TagProps<HTMLStyleElement>>;
 declare const circle: TagFunction<SVGCircleElement, TagProps<SVGCircleElement>>;
 declare const ellipse: TagFunction<SVGEllipseElement, TagProps<SVGEllipseElement>>;
@@ -2221,4 +2247,4 @@ declare const untracked: ReactiveApi["untracked"];
 declare const retrack: ReactiveApi["retrack"];
 declare const setMaxDrainIterations: ReactiveApi["setMaxDrainIterations"];
 
-export { Accessor, type ActionFn, type AnchorProps, type ArrayActions, type AsyncDerivedContext, type AsyncDerivedState, type AudioProps, type ButtonProps, Component, type Context, DerivedAccessor, DynamicComponent, type EachBindings, type EachEventBindings, type EffectBody, type EffectOptions, type EnhanceContext, type EnhanceSetup, ErrorBoundary, type ErrorBoundaryOptions, type ErrorBoundaryProps, ErrorDisplay, type ErrorDisplayProps, type ErrorSeverity, type FormProps, Fragment, type ImgProps, type InputProps, type InputType, type IslandLoader, type IslandRegistration, type IslandStrategy, KeepAlive, type KeepAliveOptions, type LabelProps, type LazyIslandLoader, Loading, type LoadingProps, type LongPressOptions, MAX_DRAIN_TEARDOWNS, type MediaProps, type MountIslandsOptions, NodeChild, NodeChildren, type OnCleanup, type OptionProps, Portal, type Ref, type RuntimeErrorContext, type RuntimeErrorHandler, type RuntimeErrorPhase, type SSRStore, type SelectProps, type SlotFn, type Slots, type StoreActions, Suspense, type SuspenseProps, TagFunction, TagProps, type TextareaProps, type TypedTagFunction, type VideoProps, __resetIdCounter, a, abbr, action, address, area, array, article, aside, asyncDerived, audio, autoResize, b, base, batch, bdi, bdo, bindDynamic, blockquote, body, br, button, canvas, caption, catchError, catchErrorAsync, center, checkLeaks, circle, cite, clickOutside, clipPath, code, col, colgroup, context, copyOnClick, createId, customElement, data, datalist, dd, deepEqual, deepSignal, defer, defs, del, details, dfn, dialog, disableSSR, dispose, div, dl, dt, each, effect, ellipse, em, embed, enableSSR, enhance, enhanceAll, enqueueBatchedSignal, fieldset, figcaption, figure, font, footer, form, g, getAction, getRequestScopedCache, getRuntimeErrorHandler, getSSRStore, getSlot, h1, h2, h3, h4, h5, h6, head, header, hr, html, i, iframe, img, input, ins, isBatching, isSSR, kbd, label, lazy, lazyIsland, legend, li, line, linearGradient, link, longPress, main, map, mark, marker, marquee, mask, match, math, menu, meta, meter, mount, mountIslands, nav, nextTick, noscript, object, ol, on, onCleanup, onMount, onUnmount, optgroup, option, output, p, param, path, pattern, picture, polygon, polyline, portal, pre, progress, q, radialGradient, reactiveArray, rect, ref, registerAction, registerComponent, registerDisposer, registerIsland, replaceChildrenSafely, reportDrainRunaway, reportError, resolveComponent, retrack, rp, rt, ruby, runInSSRContext, s, samp, script, section, select, setGlobalErrorHandler, setMaxDrainIterations, setRuntimeErrorHandler, show, slot, small, source, span, stop, store, strict, strictEffect, strong, style, sub, summary, sup, svg, symbol, table, takePendingError, tbody, td, template, text, textarea, tfoot, th, thead, time, title, tr, track$1 as track, transition, trapFocus, tspan, u, ul, unregisterComponent, unregisterDisposer, unregisterIsland, untracked, use, var_, video, watch, when, withSSR, writable };
+export { Accessor, type ActionFn, type AnchorProps, type ArrayActions, type AsyncDerivedContext, type AsyncDerivedState, type AudioProps, type ButtonProps, Component, type Context, DerivedAccessor, DynamicComponent, type EachBindings, type EachEventBindings, type EffectBody, type EffectOptions, type EnhanceContext, type EnhanceSetup, ErrorBoundary, type ErrorBoundaryOptions, type ErrorBoundaryProps, ErrorDisplay, type ErrorDisplayProps, type ErrorSeverity, type FormProps, Fragment, type ImgProps, type InputProps, type InputType, type IslandLoader, type IslandRegistration, type IslandStrategy, KeepAlive, type KeepAliveOptions, type LabelProps, type LazyIslandLoader, Loading, type LoadingProps, type LongPressOptions, MAX_DRAIN_TEARDOWNS, type MediaProps, type MountIslandsOptions, NodeChild, NodeChildren, type OnCleanup, type OptionProps, Portal, type Ref, type RuntimeErrorContext, type RuntimeErrorHandler, type RuntimeErrorPhase, type SSRStore, type SelectProps, type SlotFn, type Slots, type StoreActions, Suspense, type SuspenseProps, TagFunction, TagProps, type TextareaProps, type TypedTagFunction, type VideoProps, __renderParsedTemplate, __resetIdCounter, a, abbr, action, address, area, array, article, aside, asyncDerived, audio, autoResize, b, base, batch, bdi, bdo, bindDynamic, blockquote, body, br, button, canvas, caption, catchError, catchErrorAsync, center, checkLeaks, circle, cite, clickOutside, clipPath, code, col, colgroup, context, copyOnClick, createId, customElement, data, datalist, dd, deepEqual, deepSignal, defer, defs, del, details, dfn, dialog, disableSSR, dispose, div, dl, dt, each, effect, ellipse, em, embed, enableSSR, enhance, enhanceAll, enqueueBatchedSignal, fieldset, figcaption, figure, font, footer, form, g, getAction, getRequestScopedCache, getRuntimeErrorHandler, getSSRStore, getSlot, h1, h2, h3, h4, h5, h6, head, header, hr, html, i, iframe, img, input, ins, isBatching, isSSR, kbd, label, lazy, lazyIsland, legend, li, line, linearGradient, link, longPress, main, map, mark, marker, marquee, mask, match, math, menu, meta, meter, mount, mountIslands, nav, nextTick, noscript, object, ol, on, onCleanup, onMount, onUnmount, optgroup, option, output, p, param, path, pattern, picture, polygon, polyline, portal, pre, progress, q, radialGradient, reactiveArray, rect, ref, registerAction, registerComponent, registerDisposer, registerIsland, replaceChildrenSafely, reportDrainRunaway, reportError, resolveComponent, retrack, rp, rt, ruby, runInSSRContext, s, samp, script, section, select, setGlobalErrorHandler, setMaxDrainIterations, setRuntimeErrorHandler, show, slot, small, source, span, stop, store, strict, strictEffect, strong, style, sub, summary, sup, svg, symbol, table, takePendingError, tbody, td, template, text, textarea, tfoot, th, thead, time, title, tr, track$1 as track, transition, trapFocus, tspan, u, ul, unregisterComponent, unregisterDisposer, unregisterIsland, untracked, use, var_, video, watch, when, withSSR, writable };

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   Loading,
   Portal,
   Suspense,
+  __renderParsedTemplate,
   action,
   array,
   asyncDerived,
@@ -53,7 +54,7 @@ import {
   unregisterIsland,
   when,
   writable
-} from "./chunk-XYV3EDB7.js";
+} from "./chunk-J3YQ457H.js";
 import {
   a,
   abbr,
@@ -191,33 +192,35 @@ import {
   use,
   var_,
   video
-} from "./chunk-7LUJQAOJ.js";
+} from "./chunk-Q5J2LVKH.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
+} from "./chunk-FC6KCJSA.js";
 import {
   watch
-} from "./chunk-SLM3IA34.js";
+} from "./chunk-CZPRSWSS.js";
 import {
   __resetIdCounter,
   createId
-} from "./chunk-BC2SECJD.js";
+} from "./chunk-C7AA2CZX.js";
+import "./chunk-62BDYGAG.js";
 import {
   SVG_NS,
   tagFactory
-} from "./chunk-UOL2ECCS.js";
+} from "./chunk-VWT3VXPL.js";
 import {
   bindDynamic
-} from "./chunk-FNJXNGYZ.js";
+} from "./chunk-O6TRVMJI.js";
+import "./chunk-3ACAAQIN.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-KJ3UKABJ.js";
 import "./chunk-7ZHH77QA.js";
 import {
   effect,
   on
-} from "./chunk-WEQ3DMVL.js";
+} from "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import {
   disableSSR,
   enableSSR,
@@ -234,12 +237,12 @@ import {
   external,
   isBatching,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 import {
   retrack,
   setMaxDrainIterations,
   untracked
-} from "./chunk-JWKYU5GV.js";
+} from "./chunk-TQQUN4WR.js";
 import {
   MAX_DRAIN_TEARDOWNS,
   checkLeaks,
@@ -263,6 +266,7 @@ export {
   Portal,
   SVG_NS,
   Suspense,
+  __renderParsedTemplate,
   __resetIdCounter,
   a,
   abbr,

package/dist/motion.cjs

@@ -761,7 +761,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;

package/dist/motion.js

@@ -20,10 +20,10 @@ import {
   stagger,
   transition,
   viewTransition
-} from "./chunk-UNWRJRKC.js";
+} from "./chunk-LI4W3U6C.js";
 import "./chunk-5HZXGZ6T.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   TransitionGroup,

package/dist/patterns.cjs

@@ -657,7 +657,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -856,6 +856,9 @@ function stripUnsafeKeys(obj) {
 }
 
 // src/patterns/machine.ts
+function ownEntry(table, key) {
+  return Object.hasOwn(table, key) ? table[key] : void 0;
+}
 function machine(config) {
   const [state2, setState] = signal(config.initial);
   const [context, setContext] = signal(config.context || {});
@@ -877,9 +880,9 @@ function machine(config) {
     }
   }
   function step(event) {
-    const stateDef = config.states[currentState];
+    const stateDef = ownEntry(config.states, currentState);
     if (!stateDef?.on) return;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return;
     let target;
     let guard;
@@ -907,7 +910,7 @@ function machine(config) {
       if (action) setContext(nextContext);
       setState(target);
     });
-    const targetDef = config.states[target];
+    const targetDef = ownEntry(config.states, target);
     if (targetDef?.entry) {
       targetDef.entry(currentContext);
     }
@@ -917,7 +920,7 @@ function machine(config) {
     if (processing) return;
     drain();
   }
-  const initialDef = config.states[config.initial];
+  const initialDef = ownEntry(config.states, config.initial);
   if (initialDef?.entry) {
     processing = true;
     try {
@@ -935,9 +938,9 @@ function machine(config) {
   }
   function can(event) {
     const currentState2 = state2();
-    const stateDef = config.states[currentState2];
+    const stateDef = ownEntry(config.states, currentState2);
     if (!stateDef?.on) return false;
-    const transition = stateDef.on[event];
+    const transition = ownEntry(stateDef.on, event);
     if (!transition) return false;
     if (typeof transition === "string") return true;
     if (transition.guard) {

package/dist/patterns.js

@@ -5,7 +5,7 @@ import {
   optimisticList,
   persisted,
   timeline
-} from "./chunk-XZR4PXRE.js";
+} from "./chunk-RGLPEBDE.js";
 import {
   RenderProp,
   assertType,
@@ -22,12 +22,12 @@ import {
   withProps,
   withWrapper
 } from "./chunk-TUCPL2HB.js";
-import "./chunk-H3SRKIYX.js";
-import "./chunk-RUSSKG6G.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-KJ3UKABJ.js";
+import "./chunk-V3LHZSU5.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   RenderProp,

package/dist/performance.cjs

@@ -923,7 +923,7 @@ function forEachSubscriber(signal2, visit) {
 }
 
 // src/reactivity/track.ts
-var _runtimeVersion = true ? "4.7.0" : "dev";
+var _runtimeVersion = true ? "4.8.0" : "dev";
 var REGISTRY_KEY = /* @__PURE__ */ Symbol.for("sibujs.reactive.v1");
 function resolveReactiveApi() {
   const g = globalThis;
@@ -1321,12 +1321,20 @@ function uniqueId(suffix) {
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
 }
+var ASCII_UPPER = /[A-Z]/;
+var ASCII_UPPER_G = /[A-Z]/g;
+function canonicalAttrName(name) {
+  return ASCII_UPPER.test(name) ? name.replace(ASCII_UPPER_G, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32)) : name;
+}
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
 var OUTER_TRIM = /^[\x00-\x20\x7f-\x9f]+|[\x00-\x20\x7f-\x9f]+$/g;
 function sanitizeUrl(url) {
   const probe = stripControlChars(url).trim();
   if (!probe) return "";
   const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
   const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i = 0; i < lower.length; i++) {
@@ -1344,6 +1352,15 @@ function sanitizeUrl(url) {
   return output;
 }
 
+// src/utils/elementPolicy.ts
+var BLOCKED_ELEMENTS = /* @__PURE__ */ new Set(["script", "iframe", "object", "embed", "frame", "frameset"]);
+function canonicalTagName(tag) {
+  return canonicalAttrName(tag);
+}
+function isBlockedElement(tag) {
+  return BLOCKED_ELEMENTS.has(canonicalTagName(tag));
+}
+
 // src/performance/domRecycler.ts
 var DOMPool = class {
   constructor(maxSize = 50) {
@@ -1354,6 +1371,9 @@ var DOMPool = class {
    * Get a recycled element or create a new one.
    */
   acquire(tag) {
+    if (isBlockedElement(tag)) {
+      throw new Error(`DOMPool: refusing to create <${tag}> \u2014 tag is blocked for security reasons.`);
+    }
     const pool = this.pools.get(tag);
     if (pool && pool.length > 0) {
       const el = pool.pop();
@@ -1459,10 +1479,19 @@ function prefetch(url) {
 }
 function preloadImage(src) {
   return new Promise((resolve, reject) => {
+    const safe = sanitizeUrl(String(src));
+    if (!safe) {
+      reject(
+        new Error(
+          String(src).trim() === "" ? "preloadImage: no image URL was given." : "preloadImage: refusing an image URL outside the URL policy."
+        )
+      );
+      return;
+    }
     const img = new Image();
     img.onload = () => resolve(img);
     img.onerror = reject;
-    img.src = src;
+    img.src = safe;
   });
 }
 

package/dist/performance.d.cts

@@ -1,5 +1,5 @@
-import { T as TrustedHTML } from './ssr-Bli9XRW5.cjs';
-export { t as trustHTML } from './ssr-Bli9XRW5.cjs';
+import { T as TrustedHTML } from './ssr-C8hgIAw7.cjs';
+export { t as trustHTML } from './ssr-C8hgIAw7.cjs';
 
 declare const Priority: {
     readonly IMMEDIATE: 0;
@@ -144,6 +144,16 @@ declare function preloadResource(url: string, type?: "script" | "style" | "fetch
 declare function prefetch(url: string): void;
 /**
  * Preloads an image and returns a promise that resolves when loaded.
+ *
+ * The URL goes through the same canonical policy (`sanitizeUrl`) as
+ * `preloadResource()`, `prefetch()` and every attribute writer, BEFORE an
+ * `Image` exists: a refused URL creates no element and starts no request. The
+ * promise then rejects with an `Error` — never stays pending — so an `await`
+ * cannot hang on it. The message does not repeat the URL.
+ *
+ * An empty (or whitespace-only) `src` names no image, which is not a policy
+ * refusal; it rejects with its own message, as the browser would have fired
+ * `error` for it anyway.
  */
 declare function preloadImage(src: string): Promise<HTMLImageElement>;
 

package/dist/performance.d.ts

@@ -1,5 +1,5 @@
-import { T as TrustedHTML } from './ssr-Bli9XRW5.js';
-export { t as trustHTML } from './ssr-Bli9XRW5.js';
+import { T as TrustedHTML } from './ssr-C8hgIAw7.js';
+export { t as trustHTML } from './ssr-C8hgIAw7.js';
 
 declare const Priority: {
     readonly IMMEDIATE: 0;
@@ -144,6 +144,16 @@ declare function preloadResource(url: string, type?: "script" | "style" | "fetch
 declare function prefetch(url: string): void;
 /**
  * Preloads an image and returns a promise that resolves when loaded.
+ *
+ * The URL goes through the same canonical policy (`sanitizeUrl`) as
+ * `preloadResource()`, `prefetch()` and every attribute writer, BEFORE an
+ * `Image` exists: a refused URL creates no element and starts no request. The
+ * promise then rejects with an `Error` — never stays pending — so an `await`
+ * cannot hang on it. The message does not repeat the URL.
+ *
+ * An empty (or whitespace-only) `src` names no image, which is not a policy
+ * refusal; it rejects with its own message, as the browser would have fired
+ * `error` for it anyway.
  */
 declare function preloadImage(src: string): Promise<HTMLImageElement>;
 

package/dist/performance.js

@@ -33,16 +33,18 @@ import {
   transitionState,
   uniqueId,
   yieldToMain
-} from "./chunk-BSY63EM6.js";
+} from "./chunk-C5PEWEGH.js";
 import {
   trustHTML
-} from "./chunk-HURREPU2.js";
-import "./chunk-2INLLLMZ.js";
+} from "./chunk-FC6KCJSA.js";
+import "./chunk-62BDYGAG.js";
+import "./chunk-3ACAAQIN.js";
 import "./chunk-7ZHH77QA.js";
-import "./chunk-WEQ3DMVL.js";
+import "./chunk-V3LHZSU5.js";
+import "./chunk-EXXSN3BW.js";
 import "./chunk-7XHATCIH.js";
-import "./chunk-FQRUXCEE.js";
-import "./chunk-JWKYU5GV.js";
+import "./chunk-DSID757X.js";
+import "./chunk-TQQUN4WR.js";
 import "./chunk-NYNYSPK7.js";
 export {
   DOMPool,