sibujs 4.7.0 → 4.8.0

package/dist/{chunk-2INLLLMZ.js → chunk-EXXSN3BW.js}

@@ -6,8 +6,10 @@ import {
 function stripControlChars(value) {
   return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
 }
+var ASCII_UPPER = /[A-Z]/;
+var ASCII_UPPER_G = /[A-Z]/g;
 function canonicalAttrName(name) {
-  return name.replace(/[A-Z]/g, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32));
+  return ASCII_UPPER.test(name) ? name.replace(ASCII_UPPER_G, (ch) => String.fromCharCode(ch.charCodeAt(0) + 32)) : name;
 }
 function isEventHandlerAttr(name) {
   if (name.length < 3) return false;
@@ -20,6 +22,9 @@ function sanitizeUrl(url) {
   const probe = stripControlChars(url).trim();
   if (!probe) return "";
   const output = url.replace(OUTER_TRIM, "");
+  if (probe.length >= 2 && (probe[0] === "\\" || probe[0] === "/") && (probe[1] === "\\" || probe[1] === "/") && (probe[0] === "\\" || probe[1] === "\\")) {
+    return "";
+  }
   const lower = probe.toLowerCase();
   let schemeEnd = -1;
   for (let i = 0; i < lower.length; i++) {
@@ -36,19 +41,58 @@ function sanitizeUrl(url) {
   if (SAFE_URL_PROTOCOLS.indexOf(scheme) === -1) return "";
   return output;
 }
-var SRCSET_DESCRIPTOR = /^\s+\d+(\.\d+)?[wx]$/;
+var SRCSET_DESCRIPTOR = /^\d+(\.\d+)?[wx]$/;
+function isSrcsetWhitespace(ch) {
+  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
+}
 function sanitizeSrcset(value) {
-  const parts = value.split(",");
+  const input = String(value);
   const out = [];
-  for (let i = 0; i < parts.length; i++) {
-    const part = parts[i].trim();
-    if (!part) continue;
-    const m = part.match(/^(\S+)(\s+.+)?$/);
-    if (!m) continue;
-    if (m[2] !== void 0 && !SRCSET_DESCRIPTOR.test(m[2])) continue;
-    const safe = sanitizeUrl(m[1]);
+  let i = 0;
+  const n = input.length;
+  while (i < n) {
+    while (i < n && (isSrcsetWhitespace(input[i]) || input[i] === ",")) i++;
+    if (i >= n) break;
+    const urlStart = i;
+    while (i < n && !isSrcsetWhitespace(input[i])) i++;
+    let url = input.slice(urlStart, i);
+    const descriptors = [];
+    if (url.endsWith(",")) {
+      url = url.replace(/,+$/, "");
+    } else {
+      let current = "";
+      let inParens = false;
+      while (i < n) {
+        const ch = input[i];
+        if (inParens) {
+          current += ch;
+          if (ch === ")") inParens = false;
+          i++;
+          continue;
+        }
+        if (isSrcsetWhitespace(ch)) {
+          if (current) descriptors.push(current);
+          current = "";
+          i++;
+          continue;
+        }
+        if (ch === ",") {
+          i++;
+          break;
+        }
+        if (ch === "(") inParens = true;
+        current += ch;
+        i++;
+      }
+      if (current) descriptors.push(current);
+    }
+    if (url === "") continue;
+    if (descriptors.length > 1) continue;
+    if (descriptors.length === 1 && !SRCSET_DESCRIPTOR.test(descriptors[0])) continue;
+    const safe = sanitizeUrl(url);
     if (!safe) continue;
-    out.push(m[2] ? `${safe}${m[2]}` : safe);
+    if (safe.startsWith(",") || safe.endsWith(",")) continue;
+    out.push(descriptors.length === 1 ? `${safe} ${descriptors[0]}` : safe);
   }
   return out.join(", ");
 }
@@ -107,8 +151,16 @@ var BLOCKED_CSS_NEEDLES = [
   "behavior:",
   "@import",
   "image-set(",
-  "filter:progid"
+  "filter:progid",
+  // CSS Images 4 `image("…")` and CSS Values 5 `src("…")` take a URL as a
+  // plain STRING, so they fetch without ever spelling `url(`. Support is thin
+  // today, which is exactly when a blocklist should get ahead of it.
+  "image(",
+  "src("
 ];
+var CSS_REASON_MOZ_BINDING = 4;
+var CSS_REASON_BEHAVIOR = 5;
+var CSS_REASON_PROGID = 8;
 function describeElement(el) {
   if (!el) return "an element";
   let out = el.tagName.toLowerCase();
@@ -132,7 +184,9 @@ function warnDroppedDeclaration(value, reason, ctx) {
       "behavior: loads and runs a remote HTC script",
       "@import pulls in a remote stylesheet",
       "image-set() fetches remote images, the same exfiltration channel as url()",
-      "filter:progid activates legacy scriptable filters"
+      "filter:progid activates legacy scriptable filters",
+      "image() fetches its string argument as a URL, the same exfiltration channel as url()",
+      "src() fetches its string argument as a URL, the same exfiltration channel as url()"
     ];
     const declaration = ctx?.property ? `${ctx.property}: ${value}` : value;
     const where = describeElement(ctx?.element);
@@ -147,27 +201,145 @@ function warnDroppedDeclaration(value, reason, ctx) {
     return `style declaration "${declaration}" was dropped by the style sanitizer on ${where} \u2014 ${reasons[reason]}. The element renders without it, which usually looks like a missing image rather than an error. Sanctioned alternatives: for a content image use an <img> element (or a <picture>); for decoration, put the rule in a stylesheet and set a class instead \u2014 stylesheet CSS is not sanitized, only inline style attributes are. If this declaration is not yours, it came from untrusted data and the drop just prevented an exfiltration.`;
   });
 }
+function normalizeCssForScan(value) {
+  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
+  return normalized.toLowerCase().replace(/\s+/g, "");
+}
 function blockedCssReason(value) {
   if (!CSS_DANGER_GATE.test(value)) return -1;
-  const normalized = value.includes("\\") ? decodeCssEscapes(value) : value;
-  const lower = normalized.toLowerCase().replace(/\s+/g, "");
+  const lower = normalizeCssForScan(value);
   for (let i = 0; i < BLOCKED_CSS_NEEDLES.length; i++) {
     if (lower.includes(BLOCKED_CSS_NEEDLES[i])) return i;
   }
   return -1;
 }
-function sanitizeCSSValue(value, context) {
-  const reason = blockedCssReason(value);
+var STYLESHEET_BLOCKED_FUNCTIONS = ["url", "image-set", "image", "src", "expression"];
+function stripCssFunctions(css) {
+  const pattern = new RegExp(`(?:-webkit-)?(${STYLESHEET_BLOCKED_FUNCTIONS.join("|")})\\s*\\(`, "gi");
+  let out = "";
+  let last = 0;
+  for (let match = pattern.exec(css); match !== null; match = pattern.exec(css)) {
+    const before = match.index > 0 ? css[match.index - 1] : "";
+    if (/[\w-]/.test(before)) continue;
+    let depth = 1;
+    let i = pattern.lastIndex;
+    let quote = "";
+    for (; i < css.length && depth > 0; i++) {
+      const ch = css[i];
+      if (quote) {
+        if (ch === "\\") i++;
+        else if (ch === quote) quote = "";
+      } else if (ch === '"' || ch === "'") quote = ch;
+      else if (ch === "(") depth++;
+      else if (ch === ")") depth--;
+    }
+    out += `${css.slice(last, match.index)}/* ${match[1].toLowerCase()}() removed */`;
+    last = i;
+    pattern.lastIndex = i;
+  }
+  return out + css.slice(last);
+}
+function sanitizeStylesheetText(css) {
+  let text = css.includes("\\") ? decodeCssEscapes(css) : css;
+  text = text.replace(/@import\b[^;{}]*;?/gi, "/* @import removed */");
+  text = stripCssFunctions(text);
+  text = text.replace(/(^|[;{\s])behavior\s*:[^;}]*;?/gi, "$1/* behavior removed */");
+  text = text.replace(/(^|[;{\s])-moz-binding\s*:[^;}]*;?/gi, "$1/* -moz-binding removed */");
+  text = text.replace(/(^|[;{\s])(-ms-)?filter\s*:[^;}]*progid[^;}]*;?/gi, "$1/* filter:progid removed */");
+  return text;
+}
+function sanitizeCSSDeclaration(property, value, context) {
+  const reason = blockedDeclarationReason(property, value);
   if (reason === -1) return value;
-  warnDroppedDeclaration(value, reason, context);
+  warnDroppedDeclaration(value, reason, { property, element: context?.element });
   return "";
 }
+function blockedDeclarationReason(property, value) {
+  const reason = blockedCssReason(value);
+  if (reason !== -1) return reason;
+  const name = canonicalAttrName(property);
+  if (name === "behavior") return CSS_REASON_BEHAVIOR;
+  if (name === "-moz-binding") return CSS_REASON_MOZ_BINDING;
+  if ((name === "filter" || name === "-ms-filter") && normalizeCssForScan(value).includes("progid:")) {
+    return CSS_REASON_PROGID;
+  }
+  return -1;
+}
+function parseStyleDeclarations(css) {
+  const chunks = [];
+  let buf = "";
+  let depth = 0;
+  let quote = "";
+  for (let i = 0; i < css.length; i++) {
+    const ch = css[i];
+    if (quote) {
+      buf += ch;
+      if (ch === "\\" && i + 1 < css.length) buf += css[++i];
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === "\\") {
+      buf += ch;
+      if (i + 1 < css.length) buf += css[++i];
+      continue;
+    }
+    if (ch === "/" && css[i + 1] === "*") {
+      const end = css.indexOf("*/", i + 2);
+      if (end === -1) return null;
+      i = end + 1;
+      continue;
+    }
+    if (ch === '"' || ch === "'") quote = ch;
+    else if (ch === "(" || ch === "[") depth++;
+    else if (ch === ")" || ch === "]") {
+      if (--depth < 0) return null;
+    } else if (ch === "{" || ch === "}") return null;
+    else if (ch === ";" && depth === 0) {
+      chunks.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (quote || depth !== 0) return null;
+  chunks.push(buf);
+  const out = [];
+  for (const chunk of chunks) {
+    const colon = chunk.indexOf(":");
+    if (colon === -1) continue;
+    const rawName = chunk.slice(0, colon).trim();
+    if (!/^(--[\w-]+|-?[a-zA-Z_][\w-]*)$/.test(rawName)) continue;
+    let value = chunk.slice(colon + 1).trim();
+    const bang = /!\s*important\s*$/i.exec(value);
+    if (bang) value = value.slice(0, bang.index).trim();
+    if (value === "") continue;
+    const property = rawName.startsWith("--") ? rawName : canonicalAttrName(rawName);
+    out.push([property, value, bang !== null]);
+  }
+  return out;
+}
+function sanitizeStyleDeclarationList(cssText, context) {
+  const input = String(cssText);
+  const declarations = parseStyleDeclarations(input);
+  if (declarations === null) {
+    if (blockedCssReason(input) !== -1) warnDroppedDeclaration(input, blockedCssReason(input), context);
+    return "";
+  }
+  const kept = [];
+  for (const [property, value, important] of declarations) {
+    const reason = blockedDeclarationReason(property, value);
+    if (reason !== -1) {
+      warnDroppedDeclaration(value, reason, { property, element: context?.element });
+      continue;
+    }
+    kept.push(`${property}: ${value}${important ? " !important" : ""}`);
+  }
+  return kept.join("; ");
+}
 function sanitizeStyleAttribute(cssText, context) {
   const input = String(cssText);
   if (input.trim() === "") return "";
-  if (typeof document === "undefined") {
-    return sanitizeCSSValue(input, context) === "" ? "" : input;
-  }
+  if (typeof document === "undefined") return sanitizeStyleDeclarationList(input, context);
   const probe = document.createElement("div");
   try {
     probe.style.cssText = input;
@@ -178,8 +350,7 @@ function sanitizeStyleAttribute(cssText, context) {
   for (let i = 0; i < probe.style.length; i++) {
     const property = probe.style[i];
     const value = probe.style.getPropertyValue(property);
-    let reason = blockedCssReason(value);
-    if (reason === -1) reason = blockedCssReason(`${property}:${value}`);
+    const reason = blockedDeclarationReason(property, value);
     if (reason !== -1) {
       warnDroppedDeclaration(value, reason, { property, element: context?.element });
       continue;
@@ -241,17 +412,22 @@ function sanitizeAttributeString(attr, value, context) {
   if (lower === "style") return sanitizeStyleAttribute(value, context);
   return value;
 }
+function resolveAttributeValue(attr, value, context) {
+  if (!isPolicyAttribute(attr)) return value;
+  const safe = sanitizeAttributeString(attr, value, context);
+  return safe === "" ? null : safe;
+}
 
 export {
   stripControlChars,
   canonicalAttrName,
   isEventHandlerAttr,
   sanitizeUrl,
-  sanitizeCSSValue,
+  sanitizeStylesheetText,
+  sanitizeCSSDeclaration,
   sanitizeStyleAttribute,
   stripHtml,
   isHtmlContentAttribute,
   isUrlAttribute,
-  isPolicyAttribute,
-  sanitizeAttributeString
+  resolveAttributeValue
 };

package/dist/{chunk-HURREPU2.js → chunk-FC6KCJSA.js}

@@ -1,12 +1,19 @@
+import {
+  readOwnGlobal
+} from "./chunk-62BDYGAG.js";
+import {
+  isCodeTextElement,
+  isForbiddenMetaEntry,
+  isForbiddenMetaSnapshot,
+  resolveMetaRefreshPolicy
+} from "./chunk-3ACAAQIN.js";
 import {
   canonicalAttrName,
   isEventHandlerAttr,
   isHtmlContentAttribute,
-  isPolicyAttribute,
-  sanitizeAttributeString,
-  sanitizeUrl,
-  stripControlChars
-} from "./chunk-2INLLLMZ.js";
+  resolveAttributeValue,
+  sanitizeUrl
+} from "./chunk-EXXSN3BW.js";
 import {
   getSSRStore
 } from "./chunk-7XHATCIH.js";
@@ -16,95 +23,6 @@ import {
   replaceChildrenSafely
 } from "./chunk-NYNYSPK7.js";
 
-// src/utils/metaRefresh.ts
-function isAsciiWhitespace(ch) {
-  return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f";
-}
-function trimAsciiWhitespace(value) {
-  let start = 0;
-  let end = value.length;
-  while (start < end && isAsciiWhitespace(value[start])) start++;
-  while (end > start && isAsciiWhitespace(value[end - 1])) end--;
-  return value.slice(start, end);
-}
-var forbidden = (reason) => ({ kind: "forbidden", reason });
-function parseMetaRefreshContent(content) {
-  const raw = trimAsciiWhitespace(stripControlChars(content));
-  if (raw === "") return forbidden("empty content");
-  let i = 0;
-  while (i < raw.length && raw[i] >= "0" && raw[i] <= "9") i++;
-  if (i === 0) return forbidden("missing or non-numeric delay");
-  const delay = Number.parseInt(raw.slice(0, i), 10);
-  if (!Number.isFinite(delay)) return forbidden("unparseable delay");
-  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
-  if (i === raw.length) return { kind: "delay-only", delay };
-  if (raw[i] !== ";" && raw[i] !== ",") return forbidden("unexpected text after delay");
-  i++;
-  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
-  const keyStart = i;
-  while (i < raw.length && !isAsciiWhitespace(raw[i]) && raw[i] !== "=") i++;
-  const key = raw.slice(keyStart, i).toLowerCase();
-  if (key !== "url") return forbidden(`unsupported refresh key ${JSON.stringify(key)}`);
-  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
-  if (raw[i] !== "=") return forbidden("missing '=' after url");
-  i++;
-  while (i < raw.length && isAsciiWhitespace(raw[i])) i++;
-  let destination;
-  const quote = raw[i];
-  if (quote === '"' || quote === "'") {
-    const close = raw.indexOf(quote, i + 1);
-    if (close === -1) return forbidden("unterminated quoted destination");
-    destination = raw.slice(i + 1, close);
-    const rest = trimAsciiWhitespace(raw.slice(close + 1));
-    if (rest !== "") return forbidden("trailing text after quoted destination");
-  } else {
-    destination = trimAsciiWhitespace(raw.slice(i));
-    if (/[;,]/.test(destination)) return forbidden("multiple refresh assignments");
-  }
-  if (destination === "") return forbidden("empty destination");
-  const sanitizedDestination = sanitizeUrl(destination);
-  if (sanitizedDestination === "") return forbidden("destination uses a disallowed protocol");
-  return { kind: "allowed", delay, destination, sanitizedDestination };
-}
-function resolveMetaRefreshPolicy(attributes) {
-  let httpEquiv;
-  let content;
-  let duplicateName;
-  const seen = /* @__PURE__ */ new Set();
-  for (const [key, value] of attributes) {
-    const canonical = canonicalAttrName(key);
-    if (seen.has(canonical)) duplicateName = canonical;
-    seen.add(canonical);
-    if (canonical === "http-equiv") httpEquiv = value;
-    else if (canonical === "content") content = value;
-  }
-  if (duplicateName !== void 0) {
-    return forbidden(`duplicate case-insensitive attribute ${JSON.stringify(duplicateName)}`);
-  }
-  if (typeof httpEquiv !== "string") return { kind: "not-refresh" };
-  if (trimAsciiWhitespace(stripControlChars(httpEquiv)).toLowerCase() !== "refresh") {
-    return { kind: "not-refresh" };
-  }
-  if (typeof content !== "string") return { kind: "not-refresh" };
-  return parseMetaRefreshContent(content);
-}
-function normalizeMetaAttributes(props) {
-  const out = /* @__PURE__ */ new Map();
-  const seen = /* @__PURE__ */ new Set();
-  for (const key of Object.keys(props)) {
-    const canonical = canonicalAttrName(key);
-    if (seen.has(canonical)) return null;
-    seen.add(canonical);
-    out.set(key, props[key]);
-  }
-  return out;
-}
-function isForbiddenMetaEntry(props) {
-  const normalized = normalizeMetaAttributes(props);
-  if (normalized === null) return true;
-  return resolveMetaRefreshPolicy(normalized).kind === "forbidden";
-}
-
 // src/utils/headEntry.ts
 var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isEmittableHeadAttrName(name) {
@@ -115,9 +33,7 @@ function isEmittableHeadAttrName(name) {
   return true;
 }
 function sanitizeHeadAttrValue(canonical, value) {
-  if (!isPolicyAttribute(canonical)) return value;
-  const safe = sanitizeAttributeString(canonical, value);
-  return safe === "" ? null : safe;
+  return resolveAttributeValue(canonical, value);
 }
 function findDuplicateAttributeName(names) {
   const seen = /* @__PURE__ */ new Set();
@@ -174,15 +90,9 @@ function serializeHeadEntry(tag, attrs) {
 }
 
 // src/platform/ssr.ts
-function isPolicyAttr(lowerName) {
-  return isPolicyAttribute(lowerName);
-}
 function isForbiddenSsrAttr(lowerName) {
   return isHtmlContentAttribute(lowerName);
 }
-function sanitizeSsrAttributeValue(lowerName, value) {
-  return sanitizeAttributeString(lowerName, value);
-}
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
@@ -213,6 +123,64 @@ var VOID_ELEMENTS = /* @__PURE__ */ new Set([
   "track",
   "wbr"
 ]);
+function findNativeGetter(proto, name) {
+  for (let p = proto; p; p = Object.getPrototypeOf(p)) {
+    const get = Object.getOwnPropertyDescriptor(p, name)?.get;
+    if (get) return get;
+  }
+  return null;
+}
+var nativeAccessorsByRealm = /* @__PURE__ */ new WeakMap();
+function nativeAccessors() {
+  const realm = Element;
+  let accessors = nativeAccessorsByRealm.get(realm);
+  if (!accessors) {
+    accessors = {
+      attributes: findNativeGetter(Element.prototype, "attributes"),
+      tagName: findNativeGetter(Element.prototype, "tagName"),
+      childNodes: findNativeGetter(Node.prototype, "childNodes"),
+      getAttribute: Element.prototype.getAttribute
+    };
+    nativeAccessorsByRealm.set(realm, accessors);
+  }
+  return accessors;
+}
+function attributesOf(el) {
+  const get = nativeAccessors().attributes;
+  return get ? get.call(el) : el.attributes;
+}
+function tagNameOf(el) {
+  const get = nativeAccessors().tagName;
+  return get ? get.call(el) : el.tagName;
+}
+function childNodesOf(node) {
+  const get = nativeAccessors().childNodes;
+  return get ? get.call(node) : node.childNodes;
+}
+function getAttributeOf(el, name) {
+  return nativeAccessors().getAttribute.call(el, name);
+}
+function serializeOpenTag(element, tag) {
+  let html = `<${tag}`;
+  const meta = tag === "meta" ? /* @__PURE__ */ new Map() : null;
+  const attrs = attributesOf(element);
+  for (let i = 0; i < attrs.length; i++) {
+    const attr = attrs[i];
+    const rawName = attr.name;
+    if (!isSafeAttrName(rawName)) continue;
+    if (isEventHandlerAttr(rawName)) continue;
+    if (isForbiddenSsrAttr(rawName)) continue;
+    const value = resolveAttributeValue(rawName.toLowerCase(), attr.value);
+    if (value === null) continue;
+    meta?.set(rawName, value);
+    html += ` ${rawName}="${escapeAttr(value)}"`;
+  }
+  if (meta && isForbiddenMetaSnapshot(meta)) return null;
+  if (!getAttributeOf(element, "data-sibu-hydrate")) {
+    html += ` data-sibu-ssr="true"`;
+  }
+  return html;
+}
 function renderToString(element) {
   if (element instanceof DocumentFragment) {
     return Array.from(element.childNodes).map((child) => {
@@ -232,35 +200,21 @@ function renderToString(element) {
   if (!(element instanceof HTMLElement)) {
     return escapeHtml(element.textContent || "");
   }
-  const tag = element.tagName.toLowerCase();
-  if (tag === "script" || tag === "style") {
+  const tag = tagNameOf(element).toLowerCase();
+  if (isCodeTextElement(tag)) {
     return DEV ? `<!--ssr:${tag}-stripped-->` : "";
   }
   if (!/^[a-z][a-z0-9-]*$/i.test(tag)) {
     return DEV ? "<!--ssr:invalid-tag-->" : "";
   }
-  let html = `<${tag}`;
-  for (const attr of Array.from(element.attributes)) {
-    const rawName = attr.name;
-    if (!isSafeAttrName(rawName)) continue;
-    if (isEventHandlerAttr(rawName)) continue;
-    if (isForbiddenSsrAttr(rawName)) continue;
-    const lowerName = rawName.toLowerCase();
-    let value = attr.value;
-    if (isPolicyAttr(lowerName)) {
-      value = sanitizeSsrAttributeValue(lowerName, value);
-      if (!value) continue;
-    }
-    html += ` ${rawName}="${escapeAttr(value)}"`;
-  }
-  if (element.dataset && !element.dataset.sibuHydrate) {
-    html += ` data-sibu-ssr="true"`;
-  }
+  const openTag = serializeOpenTag(element, tag);
+  if (openTag === null) return DEV ? `<!--ssr:${tag}-stripped-->` : "";
+  let html = openTag;
   if (VOID_ELEMENTS.has(tag)) {
     return `${html} />`;
   }
   html += ">";
-  for (const child of Array.from(element.childNodes)) {
+  for (const child of Array.from(childNodesOf(element))) {
     try {
       html += renderToString(child);
     } catch (err) {
@@ -410,12 +364,8 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
     if (!isSafeAttrName(rawKey)) continue;
     if (!allowEventHandlers && isEventHandlerAttr(rawKey)) continue;
     if (isForbiddenSsrAttr(rawKey)) continue;
-    const lowerKey = rawKey.toLowerCase();
-    let value = String(attrs[rawKey]);
-    if (isPolicyAttr(lowerKey)) {
-      value = sanitizeSsrAttributeValue(lowerKey, value);
-      if (!value) continue;
-    }
+    const value = resolveAttributeValue(rawKey.toLowerCase(), String(attrs[rawKey]));
+    if (value === null) continue;
     out.push(`${rawKey}="${escapeAttr(value)}"`);
   }
   return out.join(" ");
@@ -478,8 +428,8 @@ async function* renderToStream(element) {
     yield escapeHtml(element.textContent || "");
     return;
   }
-  const tag = element.tagName.toLowerCase();
-  if (tag === "script" || tag === "style") {
+  const tag = tagNameOf(element).toLowerCase();
+  if (isCodeTextElement(tag)) {
     if (DEV) yield `<!--ssr:${tag}-stripped-->`;
     return;
   }
@@ -487,29 +437,17 @@ async function* renderToStream(element) {
     if (DEV) yield "<!--ssr:invalid-tag-->";
     return;
   }
-  let openTag = `<${tag}`;
-  for (const attr of Array.from(element.attributes)) {
-    const rawName = attr.name;
-    if (!isSafeAttrName(rawName)) continue;
-    if (isEventHandlerAttr(rawName)) continue;
-    if (isForbiddenSsrAttr(rawName)) continue;
-    const lowerName = rawName.toLowerCase();
-    let value = attr.value;
-    if (isPolicyAttr(lowerName)) {
-      value = sanitizeSsrAttributeValue(lowerName, value);
-      if (!value) continue;
-    }
-    openTag += ` ${rawName}="${escapeAttr(value)}"`;
-  }
-  if (element.dataset && !element.dataset.sibuHydrate) {
-    openTag += ` data-sibu-ssr="true"`;
+  const openTag = serializeOpenTag(element, tag);
+  if (openTag === null) {
+    if (DEV) yield `<!--ssr:${tag}-stripped-->`;
+    return;
   }
   if (VOID_ELEMENTS.has(tag)) {
     yield `${openTag} />`;
     return;
   }
   yield `${openTag}>`;
-  for (const child of Array.from(element.childNodes)) {
+  for (const child of Array.from(childNodesOf(element))) {
     try {
       yield* renderToStream(child);
     } catch (err) {
@@ -694,8 +632,7 @@ function deserializeState(validate) {
       "[SibuJS SSR] deserializeState() called without a validate guard \u2014 tampered SSR payloads will not be detected."
     );
   }
-  const w = window;
-  const raw = w[SSR_DATA_ATTR];
+  const raw = readOwnGlobal(SSR_DATA_ATTR);
   if (raw === void 0) return void 0;
   if (validate && !validate(raw)) return void 0;
   return raw;

package/dist/{chunk-Z3OHK6QT.js → chunk-GSGNX35Q.js}

@@ -1,21 +1,21 @@
 import {
   watch
-} from "./chunk-SLM3IA34.js";
+} from "./chunk-CZPRSWSS.js";
 import {
   createId,
   domBinding,
   idSegment
-} from "./chunk-BC2SECJD.js";
+} from "./chunk-C7AA2CZX.js";
 import {
   derived
-} from "./chunk-RUSSKG6G.js";
+} from "./chunk-KJ3UKABJ.js";
 import {
   stripHtml
-} from "./chunk-2INLLLMZ.js";
+} from "./chunk-EXXSN3BW.js";
 import {
   batch,
   signal
-} from "./chunk-FQRUXCEE.js";
+} from "./chunk-DSID757X.js";
 
 // src/widgets/Combobox.ts
 var boundComboboxes = /* @__PURE__ */ new WeakMap();