tachyon-dom 0.1.0 → 0.1.1

package/README.md

@@ -1,268 +1,162 @@
 # Tachyon DOM
 
-Tachyon DOM is a small TypeScript UI runtime started from the hot paths in `js-framework-benchmark`. The first implementation focuses on keyed row workloads: bulk creation, replacement, partial text updates, row selection, swap, removal, append, and clear.
-
-The core idea is to keep a static DOM template and bind dynamic fields directly into reusable template chunks before cloning. That gives the benchmark path the same mechanical advantages as the fastest vanilla implementations while keeping the API reusable outside a single hand-written table.
-
-## Current Target
-
-The initial runtime optimizes:
-
-- chunked row creation with detached `tbody` replacement
-- direct `Text.nodeValue` writes for dynamic fields
-- local selected-row class changes
-- `insertBefore` swaps for keyed row movement
-- `textContent = ""` clears
-
-Byte weight is intentionally secondary for now. The runtime is split so benchmark-specialized code can remain separate from future general-purpose modules.
-
-## Compiler Direction
-
-The framework direction is HTML-first syntax with Solid-style fine-grained reactivity and Marko-style separated server/client compiler targets. The first compiler slice lives in `tachyon-dom/compiler` and can:
-
-- parse a single-root HTML-like template
-- extract `{expr}` text bindings
-- extract `class:name={expr}` class bindings
-- extract `on:event={handler}` event bindings
-- extract `<for each={items} key={item.id}>` keyed list boundaries
-- extract `<store count={initialCount}/>` store tags without adding DOM nodes
-- record `hydrate:id={islandId}` hydration boundaries for server/client handoff
-- record `<component name="Panel" prop={value}>` transparent component boundaries with props and local stores
-- generate `<await value={promise} then="name">` streaming fragments in the server stream target
-- render an escaped server string for the same template
-- generate a chunk-yielding streaming server target as a separate compiler output
-- generate client code that imports only the runtime helper modules it needs
-- optionally generate fine-grained client bindings through `tachyon-dom/runtime/signal`
-
-The fixed syntax surface is documented in [`docs/syntax-spec.md`](docs/syntax-spec.md).
-
-Routing is documented in [`docs/routing.md`](docs/routing.md), and runtime modules are summarized in [`docs/runtime.md`](docs/runtime.md).
-
-The compiler output is intentionally close to the current direct DOM runtime: static markup stays static, dynamic text/class/event slots are recorded as explicit paths, and generated client code can import subpath helpers such as `tachyon-dom/runtime/text`.
-
-The first server streaming adapter, `tachyon-dom/server/stream`, accepts sync or async HTML chunks and adapts them to `ReadableStream<Uint8Array>` or `Response` without building a single full HTML string first.
-
-The first list runtime path, `tachyon-dom/runtime/list`, preserves keyed row elements across updates, moves reused elements into order, patches text/class bindings, removes stale rows, and keeps event handlers current through a mutable row scope. Row events are delegated through the list container so reused rows do not need one listener per row.
-
-## App Layer
-
-`tachyon-dom/app` provides a small app definition layer for examples and applications that should not need duplicated `main.ts`, `ssr.ts`, and HTML entry files. Define pages once, render SSR documents from the same definition, and let the Vite preset serve generated HTML in development and emit normalized HTML in production. With no option, development preserves tag formatting while production normalizes it. An explicit `htmlWhitespace` policy applies identically in both modes; legacy JavaScript values use the same runtime mapping, and invalid values fail during plugin creation before a server starts. The deprecated `minifyHtml` boolean also applies to both modes when explicitly set, while `htmlWhitespace` takes precedence:
-
-Create a starter app with:
-
-```sh
-npm create tachyon-dom@latest my-app
-pnpm create tachyon-dom my-app
+Tachyon DOM is an experimental HTML-first compiler that turns static templates into direct DOM updates, using a small fine-grained runtime shared with SSR and streaming targets.
+
+> Experimental status: the compiler and runtime are ready for evaluation, examples, and incremental adoption, but public APIs may change before a stable release.
+
+## Why Tachyon DOM?
+
+- HTML stays recognizable while dynamic fields become explicit DOM paths.
+- Fine-grained updates write to cached text, attribute, class, and list targets without a virtual DOM.
+- One parsed template feeds client, buffered SSR, and streaming server targets.
+- Browser-safe runtime imports keep compiler and server dependencies out of client bundles.
+
+## Quick Example
+
+This `.td` component combines a signal-backed counter with a keyed list:
+
+```html
+<script setup lang="ts">
+const count = createSignal(0);
+const rows = createSignal([
+  { id: 1, label: "Alpha" },
+  { id: 2, label: "Beta" },
+]);
+const increment = (): void => count.update((value) => value + 1);
+</script>
+
+<main>
+  <button on:click={increment}>{count}</button>
+  <ul>
+    <for each={rows} key={row.id}>
+      <li>{row.label}</li>
+    </for>
+  </ul>
+</main>
 ```
 
-```ts
-import { defineApp } from "tachyon-dom/app";
-import { tachyonApp, tachyonDom } from "tachyon-dom/vite";
-
-export const app = defineApp({
-  pages: [
-    {
-      path: "/",
-      fileName: "index.html",
-      template: "<section><h1>{title}</h1></section>",
-      scope: { title: "Home" },
-    },
-  ],
-});
-
-export default {
-  plugins: [tachyonDom({ reactive: true }), tachyonApp(app)],
-};
-```
-
-Route-local template conventions are available through `pagesFromRouteFiles()`: `src/routes/index/page.td` maps to `/`, `src/routes/counter/page.td` maps to `/counter/`, `[id]` maps to `:id`, and `[...slug]` maps to a named wildcard. Generated starters keep these pages in `src/routes.generated.ts`; `tachyon-dom add page settings/profile` updates that registry, so the new URL is available to the app, Vite, tests, and SSR without a manual import.
-
-`defineApp()` rejects every duplicate normalized route and output filename before compilation or serving. Path aliases such as `/`, `/index.html`, `/guide`, and `/guide/` share their normalized route keys. `renderAppDocument()` throws for an unknown path instead of falling back to home. SSR adapters should use `renderAppResponse()`, which returns `{ status, html }`; missing routes retain status 404 and render either the configured `notFound` page or the built-in not-found document.
-
-`examples/full-app` is a multi-page browser example with SSR initial HTML for every page, a persistent layout, client-side routing, counters, keyed lists, forms, settings, and compiler/stream diagnostics. Run it with `pnpm example:full-app`, then open the Vite dev server root. Source pages are route-local `.td` templates, and the example Vite config generates dev/build HTML entries instead of keeping `index.html` files in source. Production output is available with `pnpm example:full-app:build`; the example config builds every generated page entry and safely condenses HTML tag syntax during build.
+The server targets escape interpolated text. The client target records direct paths to the button text and list container, then updates only those targets when their signals change.
 
-Use `tachyonDom({ templateWhitespace: "condense" })` when formatting newlines and indentation in directly imported `.td` templates should be reduced. Standard applications that compile raw route source must pass the same `templateWhitespace` value to `defineApp()` or `loadRouteApp()`. The compiler applies this opt-in policy to one shared template tree before client, buffered server, and streaming server generation. It preserves same-line spaces, non-ASCII whitespace, hydration markers, text-binding separators, RCDATA and raw-text-like elements including `title`, and inherited `xml:space="preserve"` content in SVG and MathML. A static `xml:space="default"` resets foreign-content preservation, and `foreignObject` returns to HTML whitespace rules. Formatting runs that contain line breaks become a single ASCII space, so applications whose CSS makes arbitrary whitespace significant should retain the default `"preserve"` policy.
+## What the Compiler Emits
 
-`normalizeHtmlTagWhitespace()` is a separate, parse5-validated helper that changes whitespace inside tag syntax only and copies every text node and comment byte-for-byte. The older `condenseHtmlWhitespace()`, `minifyHtml()`, `minify`, and `minifyHtml` names remain deprecated compatibility aliases. App `whitespace: "normalize-tags"`, Vite app `htmlWhitespace: "normalize-tags"`, and router `htmlWhitespace: "normalize-tags"` perform tag normalization only; they do not reduce inter-element indentation. `HtmlWhitespacePolicy` is deliberately distinct from compiler `TemplateWhitespacePolicy`, and tag-normalization options accept only `"preserve-tags" | "normalize-tags"`. Migrate the removed legacy option literal `"preserve"` to `"preserve-tags"` and `"condense"` to `"normalize-tags"`; deprecated boolean and helper aliases remain available separately. A route may provide a separate `stream` async iterable. Loaders and authoritative status and headers resolve before body iteration starts, and chunks are forwarded without collecting the completed body. Iteration failures terminate the body without injecting error HTML, and consumer cancellation closes the source iterator even if the body has not been pulled.
+The real output uses modular runtime imports and explicit cleanup ownership. Abbreviated, the hot path looks like this:
 
-### HTML whitespace policy migration
+```js
+const countText = __tachyonTextAt(root, [0, 0]);
+cleanups.push(__tachyonEffect(() => __tachyonSetText(countText, __tachyonRead(scope.count))));
 
-TypeScript consumers must replace the removed `LegacyHtmlWhitespacePolicy`, `HtmlWhitespacePolicyInput`, and `CompatibleHtmlWhitespacePolicy<T>` exports with `HtmlWhitespacePolicy`, remove the obsolete policy type parameter from app, Vite, router, Workers, Node, and Lambda option types, and use `"preserve-tags"` or `"normalize-tags"`. For example, migrate `WorkersHandlerOptions<Env, LegacyPolicy>` to `WorkersHandlerOptions<Env>` and `RouteRenderOptions<LegacyPolicy>` to `RouteRenderOptions`. Runtime compatibility remains for already-built JavaScript and JSON configuration: `"preserve"` maps to `"preserve-tags"`, and `"condense"` maps to `"normalize-tags"`. Unknown values never silently select preserve behavior, but the observable error depends on the public boundary:
-
-| Public boundary                              | Unknown runtime policy outcome                                                                                  |
-| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| App document rendering                       | Throws the migration error directly.                                                                            |
-| Vite app plugin creation                     | Throws the migration error directly before a development server or build starts.                                |
-| Buffered router                              | Resolves to the generic internal-error document with status 500 because route rendering owns an error boundary. |
-| Streaming router                             | Rejects with the migration error before returning stream metadata or chunks.                                    |
-| Workers and Node buffered adapters           | Return the buffered router's generic 500 response.                                                              |
-| Lambda proxy buffered adapter                | Returns the generic Lambda proxy response with status 500.                                                      |
-| Workers, Node, and Lambda streaming adapters | Reject before committing a response when `streaming: true` selects the streaming router.                        |
-
-## Recommended App Shape
-
-For applications, keep route markup in route-local `.td` files and let Vite run the Tachyon DOM plugins on the main development path:
-
-```text
-src/
-  routes/
-    index/
-      page.td
-      page.td.d.ts
-  routes.generated.ts
-  client/
-    main.ts
-  app.ts
-vite.config.ts
+cleanups.push(
+  __tachyonEffect(() =>
+    __tachyonMountKeyedList(listRoot, [], __tachyonRead(scope.rows), listOptions),
+  ),
+);
 ```
 
-Use `src/routes/**/page.td` as the source of truth for page markup. Use `src/client/main.ts` for client-side runtime code that should be bundled by Vite. Do not put application code in `public/client/main.js`; reserve `public/` for static assets such as images, icons, manifests, and service workers.
+Static markup remains in a reusable template. Events are attached once per created target, keyed rows retain their DOM nodes while moving, and the generated binding root disposes effects, resources, events, and controls together.
 
-Add Tachyon DOM template module types when TypeScript imports `.td` files directly:
+See the [syntax specification](docs/syntax-spec.md) for supported expressions and exact target behavior.
 
-```ts
-/// <reference types="tachyon-dom/td-modules" />
-```
-
-For project-wide setup, add `"tachyon-dom/td-modules"` to `compilerOptions.types` alongside `"vite/client"`. The type entry covers `.td`, `.td?client`, `.td?server`, `.td?stream`, and `.td?raw` imports. During normal Vite development and builds, `tachyonDom()` writes an adjacent `.td.d.ts` for each transformed template. These declarations preserve exported SFC `scope()` types, require every referenced template field, and type event handlers. The generated starter and `add page` command create the initial declarations so a clean project typechecks before its first Vite run. `tachyon-dom typegen` remains available for non-Vite tooling but is not required by the standard workflow.
-
-## Typed Templates and Environment Validation
+## Measured Size
 
-`tachyon-dom/typed` exposes the typed-template helpers used by generated template declarations:
-
-```ts
-import { defineTemplate, templateScope, type TypedTemplate } from "tachyon-dom/typed";
+`import { createSignal } from "tachyon-dom"` bundles to **600 bytes minified** in the current esbuild contract.
 
-type PageScope = {
-  title: string;
-  count: number;
-};
+Quick example client bundle: 11519 bytes minified, 3838 bytes Brotli, including the counter, keyed-list binding code, and browser runtime. CI rejects TypeScript, parse5, compiler, server, app, and language-server modules from both browser metafiles.
 
-const page = defineTemplate<PageScope, "<h1>{title}</h1>">("<h1>{title}</h1>");
-const scoped = templateScope<PageScope>().define("<p>{count}</p>");
-
-const typed: TypedTemplate<PageScope> = page;
-void typed;
-void scoped;
+```sh
+pnpm build
+pnpm check:browser-entry
+pnpm check:quick-example-size
 ```
 
-`tachyon-dom/env` provides a small runtime environment validator with a public/private split:
-
-```ts
-import { defineEnvSchema, readEnv } from "tachyon-dom/env";
-
-const schema = defineEnvSchema({
-  PUBLIC_APP_NAME: { default: "Tachyon App", public: true },
-  SESSION_SECRET: { required: true },
-});
+These numbers are produced from repository scripts, not estimated from source files. Subpath size budgets remain available through `pnpm check:size`.
 
-const result = readEnv(process.env, schema);
-if (!result.ok) {
-  throw new Error(result.error.map((error) => error.message).join("\n"));
-}
+## Keyed List Benchmark
 
-result.value.publicEnv.PUBLIC_APP_NAME;
-result.value.env.SESSION_SECRET;
-```
+On this machine, Tachyon DOM performed within 3% of the comparison implementations across nine keyed-row operations.
 
-Only keys marked `public: true` are exposed under `result.value.publicEnv`. By default public keys must use the `PUBLIC_` prefix; pass `publicPrefix` to `readEnv()` when an app uses a different convention.
+| Compared with | Tachyon DOM result |
+| --- | ---: |
+| vanillajs-lite-keyed | 1.8% faster |
+| solid-keyed | 0.9% faster |
+| marko-keyed | 2.5% slower |
 
-## Runtime APIs
+Results are the geometric mean of nine operations: row creation, replacement, partial updates, selection, swapping, removal, append, clear, and creation of many rows. Lower execution time is better.
 
-The root entry exports the small reactive runtime: `createSignal()`, `createMemo()`, `effect()`, `batch()`, `untrack()`, `createResource()`, and `catchError()`. Use `createResource(source, loader)` for signal-driven async data with `data`, `error`, `loading`, and `refetch` accessors. Source changes abort superseded loads; the loader receives an `AbortSignal`, and `resource.dispose()` detaches tracking and aborts in-flight work. Use `untrack(fn)` to read signals without subscribing the active effect, and use `catchError(fn, onError)` when an effect should recover and keep tracking after a thrown error.
+The recorded run used:
 
-`createErrorBoundary()` is available from the root entry and `tachyon-dom/runtime/error-boundary` for DOM-mounted fallback UI around client enhancements. `createI18n()` and `localeMiddleware()` are available from the root entry and `tachyon-dom/i18n` for dictionary lookup, interpolation, and request locale selection.
+- AMD Ryzen 9 9950X
+- Chromium 149.0.7827.55
+- Production Vite builds
+- 2 warmup runs and 7 measured runs per operation
+- 20% trimmed means to reduce outlier influence
 
-Adapters are lower-level deployment APIs for Node, Workers, and Lambda composition. They are useful when composing Tachyon DOM with an existing Request-to-Response handler, but an adapter-only app with TypeScript string templates is not the standard framework shape. If you are migrating an existing SSR app, start by replacing hand-written enhancement registries with `tachyon-dom/runtime/enhancement`, then move one screen at a time into `.td` templates, and finally wire those screens through the app or route layer.
+The [complete JSON artifact](benchmark/local-compare/results/2026-07-13-readme-baseline.json) includes raw samples, variability, dependency versions, and clean Git provenance.
 
-## Routing
+Reproduce the same benchmark contract locally:
 
-Routing is provided as a separate layer instead of being baked into the template compiler. The server router in `tachyon-dom/router` supports static routes, `:param` routes, wildcard routes, nested layouts through `outlet`, route loaders, form actions, auth guards, 404/error boundaries, head descriptor rendering, route hydration state scripts, trusted HTML responses, backend HTML sanitization helpers and adapters, CSRF guards, signed cookie sessions, middleware, observability hooks, deferred data helpers, CSP nonce propagation, resource hints, streaming finalization, build manifests, typed href builders, route preload plans, and route type generation. The client router in `tachyon-dom/runtime/router` supports same-origin link interception, History API navigation, `popstate`, abortable route loaders/actions, action-driven revalidation, loader cache/prefetch/invalidation, Vite route HMR revalidation, scroll-to-top hooks, focus restoration, history-entry `restoreScroll`, navigation announcements, title/head updates, nested layout outlets, optional `viewTransition`, and 404/error rendering.
+```sh
+pnpm bench:local
+```
 
-The Vite integration also exposes `tachyonDomRoutes()` for a `virtual:tachyon-dom/routes` module. It emits a manifest plus lazy dynamic imports, which keeps route modules split into separate chunks.
+This is a repository-local comparison based on the `js-framework-benchmark` row-operation model. It is not an official upstream result or a general ranking of framework performance. See the [benchmark methodology](benchmark/README.md) for details.
 
-During Vite dev server runs, `tachyonDom()` logs simple request lines such as `GET / 200 4ms` through Vite's logger. Query strings are omitted by default to avoid leaking tokens or other sensitive parameters. Disable request logs with `tachyonDom({ requestLog: false })`, pass `requestLog: { logger }` to route messages to a custom sink, or set `requestLog: { includeQuery: true }` when query strings are explicitly useful.
+## Install
 
-For request-scoped dynamic SSR, use `tachyonSsr()` in the Vite plugin list. It mounts a fetch-style `Request -> Response` handler in Vite dev, passes Vite module URLs such as `/@vite/client`, `/src/`, and `/node_modules/` through to Vite, and can serve public assets before the dynamic handler through the Node adapter static asset semantics:
+Create a route-local starter:
 
-```ts
-import { defineConfig } from "vite";
-import { tachyonDom, tachyonSsr } from "tachyon-dom/vite";
-
-const clientScript = (request: Request) =>
-  new URL(request.url).searchParams.has("prod") ? "/client/main.js" : "/src/client/main.ts";
-
-export default defineConfig({
-  plugins: [
-    tachyonDom({ reactive: true }),
-    tachyonSsr({
-      clientScript,
-      fetch: async (request, { clientScript }) => {
-        const user = new URL(request.url).searchParams.get("user") ?? "Guest";
-        return new Response(`<main>Hello ${user}</main><script type="module" src="${clientScript ?? ""}"></script>`, {
-          headers: { "content-type": "text/html; charset=utf-8" },
-        });
-      },
-    }),
-  ],
-});
+```sh
+npm create tachyon-dom@latest my-app
+cd my-app
+pnpm install
+pnpm dev
 ```
 
-Server adapters live in `tachyon-dom/adapters` as compatibility exports, with runtime-specific entries at `tachyon-dom/adapters/node`, `tachyon-dom/adapters/workers`, and `tachyon-dom/adapters/lambda`. The Workers entry avoids Node built-ins and can serve Cloudflare Assets bindings before dynamic routes; the Node entry keeps file-system static asset serving; the Lambda entry supports Function URL and API Gateway HTTP API v2 style events, including AWS Lambda response streaming. When a Node app serves public files from a root `staticAssets.basePath`, set `staticAssets.fallthroughOnNotFound: true` to let missing files such as `/healthz`, `/`, or non-GET/HEAD app routes like `POST /login` continue to the app handler while still serving files that exist. `tachyon-dom/runtime/form` includes progressive form enhancement, `tachyon-dom/runtime/enhancement` adds small opt-in client behavior for SSR markup via `data-td-enhance`, and `tachyon-dom/runtime/hydrate` includes boundary mismatch diagnostics for SSR tests and development builds.
+The equivalent pnpm command is `pnpm create tachyon-dom my-app`. For an installed package, use `tachyon-dom init --template basic --out my-app` or select the `ssr` template.
 
-For Cloudflare Pages, `tachyon-dom/vite` exposes `packageCloudflarePages()` to copy static assets and generate a Pages `_worker.js` that tries `env.ASSETS` before delegating to a Tachyon DOM SSR renderer.
+The normal project shape keeps route markup in `src/routes/**/page.td`, client code in `src/client/main.ts`, and generated route registration in `src/routes.generated.ts`. Start with the [getting-started guide](docs/getting-started.md).
 
-Server-rendered string helpers live under `tachyon-dom/server/html` and `tachyon-dom/server/form-action`. The HTML helper escapes interpolation by default, provides explicit `attr()`, `booleanAttr()`, `classList()`, `join()`, and `rawHtml()` helpers, and does not require DOM globals. The form action helper keeps validation in userland while standardizing `FormData` parsing, safe value preservation, accessible field error attributes, and path-relative redirect responses for classic SSR forms.
+## Compiler and Runtime Boundaries
 
-## Testing Templates
-
-`tachyon-dom/testing` includes helpers for fast server-side assertions without starting Vite. Use `renderTdForTest(filePath, scope, { locale })` in Vitest when you want to assert the SSR HTML for a `.td` template directly:
+The package root contains browser-safe reactive and runtime APIs such as `createSignal()`, `createMemo()`, `createResource()`, `createRoot()`, `onCleanup()`, and the client router. Heavier tools use explicit subpaths:
 
 ```ts
-import { expect, it } from "vitest";
-import { renderTdForTest } from "tachyon-dom/testing";
-
-it("escapes user content in the account view", async () => {
-  await expect(
-    renderTdForTest("src/account-view.td", {
-      userName: `<img src=x onerror=alert(1)>`,
-    }),
-  ).resolves.toContain("&lt;img src=x onerror=alert(1)&gt;");
-});
+import { createSignal } from "tachyon-dom";
+import { compileTemplate } from "tachyon-dom/compiler";
+import { defineApp } from "tachyon-dom/app";
+import { createRouter } from "tachyon-dom/router";
+import { html } from "tachyon-dom/server/html";
+import { tachyonDom } from "tachyon-dom/vite";
 ```
 
-The helper reads and compiles the template with Tachyon DOM diagnostics, then renders it through the server target. Compiler errors include the template file path, line, column, source line, and pointer so failures are suitable for normal unit-test output.
-
-## Security Notes
+This boundary keeps TypeScript, parse5, language-server, app, and server graphs away from a browser consumer that only needs reactivity.
 
-`sanitizeHtml(markup)` has a small built-in allowlist sanitizer for constrained, already-simple backend HTML. Do not rely on the default sanitizer for arbitrary untrusted HTML. For user-generated or third-party markup, pass a vetted adapter through `createHtmlSanitizer()`/`sanitizeHtml(..., { adapter })`, such as a DOMPurify-backed sanitizer in the target runtime.
+## Documentation
 
-Progressive route `stream()` strings are trusted raw HTML. Node, Workers, and Lambda adapters never escape or sanitize chunks. Escape untrusted text explicitly:
+- [Getting started](docs/getting-started.md): starter creation, project shape, route files, template types, and testing.
+- [Syntax specification](docs/syntax-spec.md): HTML-first syntax, expressions, directives, components, hydration, and streaming constructs.
+- [Runtime](docs/runtime.md): signals, ownership, DOM helpers, keyed lists, forms, enhancements, portals, and hydration.
+- [App and Vite](docs/app-vite.md): app definitions, file routes, plugins, request-scoped SSR, logging, and packaging.
+- [Routing](docs/routing.md): server routes, layouts, loaders, actions, streaming, and client navigation.
+- [Server adapters](docs/adapters.md): Workers, Node, Lambda, static assets, origins, and deployment behavior.
+- [Security](docs/security.md): escaping, trusted HTML, sanitizers, redirects, CSRF, hosts, proxies, and origins.
+- [Whitespace migration](docs/migrations/whitespace.md): compiler versus document policies, legacy mappings, and boundary outcomes.
+- [Benchmarks](benchmark/README.md): provenance, contracts, reproduction, and interpretation.
+- [Releasing](docs/releasing.md): package verification, Trusted Publishing, and release commands.
+- [Changelog](CHANGELOG.md): release history, breaking changes, fixes, and security notes.
 
-```ts
-import { escapeToHtml, trustedHtmlChunk, type RouteDefinition } from "tachyon-dom/router";
-
-const route: RouteDefinition = {
-  path: "/search",
-  loader: ({ url }) => url.searchParams.get("q") ?? "",
-  render: () => "",
-  stream: async function* ({ data }) {
-    yield `<p>${trustedHtmlChunk(escapeToHtml(data))}</p>`;
-  },
-};
-```
+## Security
 
-`escapeToHtml()` is for HTML text content, not unquoted attributes, script/style source, URLs, or other parser contexts. For intentionally accepted markup, use a vetted sanitizer adapter and pass its factory-created `TrustedHtml` through `trustedHtmlChunk()`; forged structural objects are rejected.
+Template interpolation and `tachyon-dom/server/html` escape text by default. `rawHtml()`, `trustedHtmlChunk()`, and route `stream()` chunks are explicit trust boundaries. Sanitize user-generated markup with a vetted runtime adapter, configure public origins and trusted proxy behavior, and apply method plus CSRF/Origin checks before direct form actions.
 
-`tachyon-dom/server/html` is an escaping helper, not a sanitizer. Use `rawHtml()` only for trusted framework or application output. Sanitize user-generated HTML before it reaches `rawHtml()`.
+See the [security guide](docs/security.md) before deploying server-rendered or streamed applications.
 
-The built-in sanitizer rejects protocol-relative URLs and removes absolute `http:`/`https:` URLs unless their origin is explicitly listed in `allowedUrlOrigins`. `redirect()` similarly accepts path-relative targets by default; external redirects require `allowExternal: true` plus an `allowedOrigins` entry for the target origin.
+## Project Status
 
-The Node adapter derives request URLs from `Host` only when you pass `trustedHosts`, or from a fixed `origin` when configured. Without either option it falls back to `localhost` instead of trusting the incoming `Host` header. Only enable `trustProxy` behind a trusted proxy or edge that normalizes forwarded headers.
+The current compiler supports text, class, attribute, style, ref, model, and event bindings; keyed lists and conditionals; local stores and components; hydration boundaries; buffered SSR; and streaming targets. The runtime uses fine-grained reactive ownership so component cleanup stops effects, aborts resources, and detaches DOM bindings.
 
-The Lambda adapter derives request URLs from `event.requestContext.domainName` by default and falls back to the `Host` header for minimal local events. Pass `origin` when the public origin differs from the Lambda event domain, for example behind CloudFront or a custom domain.
+Tachyon DOM is still experimental. Evaluate compatibility, output, accessibility, security boundaries, and benchmark relevance for your application before production adoption.
 
-## Commands
+## Development
 
 ```sh
 pnpm install
@@ -271,69 +165,18 @@ pnpm build
 pnpm lint
 pnpm check:exports
 pnpm check:size
-pnpm bench:local
-pnpm bench:local:dev
-pnpm bench:local:full
-pnpm bench:local:gate
-pnpm bench:local:smoke
+pnpm check:browser-entry
+pnpm check:quick-example-size
 ```
 
-The package CLI also exposes:
-
-```sh
-tachyon-dom compile view.td --target client --out view.js
-tachyon-dom routes src/routes --out route-manifest.json
-tachyon-dom typegen src/routes/index/page.td --out src/routes/index/page.td.ts
-tachyon-dom add page settings/profile --routes-dir src/routes
-npm create tachyon-dom@latest my-app
-pnpm create tachyon-dom my-app
-tachyon-dom init --template basic --out my-app
-tachyon-dom dev --host 127.0.0.1 --port 5173
-tachyon-dom build
-tachyon-dom preview --host 127.0.0.1 --port 4173
-tachyon-dom language-server --stdio
-```
-
-`npm create tachyon-dom@latest my-app` and `pnpm create tachyon-dom my-app` create a route-local starter with `src/routes/index/page.td`, `src/client/main.ts`, `src/app.ts`, `vite.config.ts`, `tsconfig.json`, `.gitignore`, a smoke test, CI workflow, `README.md`, and `package.json`. `tachyon-dom init --template basic --out my-app` is the equivalent installed-package command. Use `tachyon-dom init --template ssr --out my-app` when you also want a small `src/server.ts` SSR composition entry.
-
-`tachyon-dom init` and `tachyon-dom add page` preserve existing files by default. A starter conflict aborts before any file is written. Pass `--force` only when you deliberately want to overwrite the listed managed files; the command reports every overwritten path.
-
-`tachyon-dom add page` also reports the normalized route URL, adjacent declaration file, and generated registry it changed. For example, `users/[id]` reports `/users/:id/`, while `blog/[...slug]` reports `/blog/*slug/`.
-
-Template files use the short `.td` extension. The Vite plugin and file router also accept `.tachyon` and `.tachyon.html` for compatibility.
-
-`tachyon-dom language-server --stdio` starts a minimal Language Server Protocol server for editor integrations. The first version reports Tachyon template diagnostics for `.td`, `.tachyon`, and `.tachyon.html` documents; completion, hover, and semantic tokens are intentionally left to later editor-support slices.
-
-`pnpm bench:local` builds every implementation in production mode (bundled and minified, matching what applications ship), serves them from a temporary Vite preview server, measures Tachyon DOM against local copies of the keyed vanilla benchmark implementations in Playwright Chromium, prints ratio tables, and writes JSON results under `benchmark/local-compare/results/`. Production is the canonical mode because dev-server module loading adds overhead that does not exist in a shipped app.
-
-`pnpm bench:local:dev` runs the same comparison against the unbundled dev server for fast local iteration (no production build step).
-
-`pnpm bench:local:full` runs the canonical production comparison with extra warmup and measured iterations for noisier performance investigations.
-
-`pnpm bench:local:smoke` runs the same local comparison with one warmup and one measured iteration for manual benchmark smoke checks. The CI workflow exposes it through `workflow_dispatch`; normal push and pull request runs skip the benchmark.
-
-`pnpm bench:local:gate` runs the local comparison with operation and memory regression thresholds.
-
-The local benchmark prints row-operation timings plus auxiliary metrics for startup, JS heap usage, DOM node counts, and local source size. JSON output also keeps per-run values with mean, median, min, max, and p95.
-
-`pnpm check:exports` runs `publint --strict` and `attw --pack --no-emoji` against the package exports and declaration files. `pnpm check:size` runs per-subpath size budgets for the root entry, selected runtime helpers including `runtime/signal`, `runtime/list`, `runtime/error-boundary`, the client router, `i18n`, and the server HTML helper. CI runs both gates after `pnpm build` and `pnpm verify:package`.
-
-Version tags matching `v*` publish through GitHub Actions with `npm publish --access public` after the same build, package, exports, and size checks pass. npm provenance is intentionally omitted because this source repository is private.
-
-## Example
+Useful examples:
 
 ```sh
 pnpm example:web
-```
-
-Open `http://127.0.0.1:5173/examples/web/` to try the browser example. It shows the compiled SSR preview, hydrate boundary markers, store updates, keyed list updates, stream chunks, and generated client module shape in one page.
-
-Open `http://127.0.0.1:5173/examples/auth-todo/` for the authenticated todo example. Browser example HTML entries are generated by the Vite dev plugin, so these examples do not need hand-written `index.html` files.
-
-```sh
+pnpm example:full-app
 pnpm example:stream
 ```
 
-The CLI example in `examples/store-hydrate-stream.ts` prints the streamed SSR HTML for the same store/hydrate/streaming slice.
+## License
 
-`examples/router.ts` shows nested route rendering with a loader, route head tags, and route hydration state.
+MIT

package/dist/cli.js

@@ -541,7 +541,7 @@ const starterPackageJsonSource = () => `${JSON.stringify({
         typecheck: "tsc --noEmit",
     },
     dependencies: {
-        "tachyon-dom": "^0.1.0",
+        "tachyon-dom": "^0.1.1",
     },
     devDependencies: {
         "@types/node": "^24.0.3",

package/dist/compiler/expression.d.ts

@@ -10,6 +10,10 @@ export type ExpressionNode = {
 } | {
     type: "literal";
     value: string | number | boolean | null;
+} | {
+    type: "regex";
+    pattern: string;
+    flags: string;
 } | {
     type: "array";
     items: ExpressionNode[];

package/dist/compiler/expression.js

@@ -344,7 +344,7 @@ const validateExpressionNode = (node) => {
         }
         return ok(node);
     }
-    if (node.type === "literal") {
+    if (node.type === "literal" || node.type === "regex") {
         return ok(node);
     }
     if (node.type === "array") {
@@ -454,6 +454,10 @@ const loadOxcParser = () => {
 };
 const oxcExpressionToNode = (node) => {
     if (node.type === "Literal") {
+        const regex = "regex" in node ? node.regex : undefined;
+        if (regex) {
+            return ok({ type: "regex", pattern: regex.pattern, flags: regex.flags });
+        }
         if (typeof node.value === "string" ||
             typeof node.value === "number" ||
             typeof node.value === "boolean" ||
@@ -657,6 +661,9 @@ export const evaluateExpressionNode = (node, scope) => {
     if (node.type === "literal") {
         return node.value;
     }
+    if (node.type === "regex") {
+        return new RegExp(node.pattern, node.flags);
+    }
     if (node.type === "array") {
         return node.items.map((item) => evaluateExpressionNode(item, scope));
     }
@@ -797,6 +804,9 @@ export const expressionNodeToJs = (node, locals = new Set(), scopeName = "scope"
     if (node.type === "literal") {
         return JSON.stringify(node.value);
     }
+    if (node.type === "regex") {
+        return `new RegExp(${JSON.stringify(node.pattern)}, ${JSON.stringify(node.flags)})`;
+    }
     if (node.type === "array") {
         return `[${node.items.map((item) => expressionNodeToJs(item, locals, scopeName)).join(", ")}]`;
     }

package/dist/compiler/index.js

@@ -5,11 +5,20 @@ import { lowerClientTemplate } from "./targets/client.js";
 import { applyTemplateWhitespace } from "./whitespace.js";
 const compileCacheLimit = 128;
 const compileCache = new Map();
+const deepFreeze = (value, seen = new WeakSet()) => {
+    if (value === null || typeof value !== "object" || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const child of Object.values(value))
+        deepFreeze(child, seen);
+    return Object.freeze(value);
+};
 const rememberCompiledTemplate = (cacheKey, result) => {
+    const frozenResult = deepFreeze(result);
     if (compileCache.has(cacheKey)) {
         compileCache.delete(cacheKey);
     }
-    compileCache.set(cacheKey, result);
+    compileCache.set(cacheKey, frozenResult);
     while (compileCache.size > compileCacheLimit) {
         const oldest = compileCache.keys().next().value;
         if (oldest === undefined) {
@@ -17,7 +26,7 @@ const rememberCompiledTemplate = (cacheKey, result) => {
         }
         compileCache.delete(oldest);
     }
-    return result;
+    return frozenResult;
 };
 export const compileTemplate = (source, options = {}) => {
     const whitespace = options.whitespace ?? "preserve";
@@ -37,12 +46,12 @@ export const compileTemplate = (source, options = {}) => {
     if (!irResult.ok) {
         return rememberCompiledTemplate(cacheKey, err(irResult.error));
     }
-    return rememberCompiledTemplate(cacheKey, ok({
+    return rememberCompiledTemplate(cacheKey, ok(deepFreeze({
         source,
         ir: irResult.value,
         root: irResult.value.root,
         client: lowerClientTemplate(irResult.value.root),
-    }));
+    })));
 };
 export * from "./types.js";
 export { generateClientModule } from "./targets/client.js";

package/dist/compiler/parser.js

@@ -46,34 +46,117 @@ const readQuotedValue = (parser) => {
 };
 const readBracedValue = (parser) => {
     let depth = 0;
-    let quote;
+    let mode = "code";
+    let escaped = false;
+    let regexCharacterClass = false;
+    let canStartRegex = true;
+    const templateExpressionDepths = [];
     const start = parser.offset;
     while (parser.offset < parser.source.length) {
         const char = parser.source[parser.offset];
-        const previous = parser.source[parser.offset - 1];
-        if (quote) {
-            if (char === quote && previous !== "\\") {
-                quote = undefined;
+        const next = parser.source[parser.offset + 1];
+        if (mode === "line-comment") {
+            if (char === "\n" || char === "\r")
+                mode = "code";
+            parser.offset++;
+            continue;
+        }
+        if (mode === "block-comment") {
+            if (char === "*" && next === "/") {
+                mode = "code";
+                parser.offset += 2;
+            }
+            else {
+                parser.offset++;
+            }
+            continue;
+        }
+        if (mode === "single" || mode === "double") {
+            if (!escaped && char === (mode === "single" ? "'" : '"'))
+                mode = "code";
+            escaped = !escaped && char === "\\";
+            parser.offset++;
+            continue;
+        }
+        if (mode === "regex") {
+            if (!escaped) {
+                if (char === "[")
+                    regexCharacterClass = true;
+                if (char === "]")
+                    regexCharacterClass = false;
+                if (char === "/" && !regexCharacterClass) {
+                    mode = "code";
+                    canStartRegex = false;
+                }
+            }
+            escaped = !escaped && char === "\\";
+            parser.offset++;
+            continue;
+        }
+        if (mode === "template") {
+            if (!escaped && char === "`") {
+                mode = "code";
+                canStartRegex = false;
+                parser.offset++;
+                continue;
+            }
+            if (!escaped && char === "$" && next === "{") {
+                depth++;
+                templateExpressionDepths.push(depth);
+                mode = "code";
+                canStartRegex = true;
+                parser.offset += 2;
+                continue;
             }
+            escaped = !escaped && char === "\\";
+            parser.offset++;
+            continue;
+        }
+        if (char === "/" && next === "/") {
+            mode = "line-comment";
+            parser.offset += 2;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            mode = "block-comment";
+            parser.offset += 2;
+            continue;
+        }
+        if (char === "/" && canStartRegex) {
+            mode = "regex";
+            escaped = false;
+            regexCharacterClass = false;
             parser.offset++;
             continue;
         }
-        if (char === `"` || char === `'`) {
-            quote = char;
+        if (char === `"` || char === `'` || char === "`") {
+            mode = char === `"` ? "double" : char === `'` ? "single" : "template";
+            escaped = false;
             parser.offset++;
             continue;
         }
         if (char === "{") {
             depth++;
+            canStartRegex = true;
         }
         else if (char === "}") {
             depth--;
             parser.offset++;
+            if (templateExpressionDepths.at(-1) === depth + 1) {
+                templateExpressionDepths.pop();
+                mode = "template";
+                escaped = false;
+                continue;
+            }
             if (depth === 0) {
                 return ok(parser.source.slice(start, parser.offset));
             }
+            canStartRegex = false;
             continue;
         }
+        else if (!isWhitespace(char)) {
+            canStartRegex = "([,:;!?=+-*%&|^~<>".includes(char);
+        }
         parser.offset++;
     }
     return parserError(parser, "Unclosed braced attribute value.");

package/dist/compiler/sfc.js

@@ -7,20 +7,20 @@ export const sfcSetupScopeName = "__tachyonSfcSetupScope";
 const scriptOpenPattern = /<script\b([^>]*)>/gi;
 const autoImports = {
     batch: "tachyon-dom",
-    compileTachyonSfc: "tachyon-dom",
-    createClientRouter: "tachyon-dom",
+    compileTachyonSfc: "tachyon-dom/compiler",
+    createClientRouter: "tachyon-dom/runtime/router",
     createMemo: "tachyon-dom",
     createSignal: "tachyon-dom",
     createStore: "tachyon-dom",
     effect: "tachyon-dom",
     enhanceForm: "tachyon-dom",
     err: "tachyon-dom",
-    generateClientModule: "tachyon-dom",
-    generateServerStreamModule: "tachyon-dom",
+    generateClientModule: "tachyon-dom/compiler",
+    generateServerStreamModule: "tachyon-dom/compiler",
     ok: "tachyon-dom",
     readTextStreamChunks: "tachyon-dom",
-    renderServerTemplate: "tachyon-dom",
-    renderToReadableStream: "tachyon-dom",
+    renderServerTemplate: "tachyon-dom/compiler",
+    renderToReadableStream: "tachyon-dom/server/stream",
     validateFormData: "tachyon-dom",
 };
 const autoImportPattern = new RegExp(`\\b(?:${Object.keys(autoImports)

package/dist/compiler/targets/client.js

@@ -257,6 +257,7 @@ const scopeName = (usesStore) => (usesStore ? "state" : "scope");
 const runtimeNames = {
     bindControl: "__tachyonBindControl",
     createStore: "__tachyonCreateStore",
+    createRoot: "__tachyonCreateRoot",
     delegate: "__tachyonDelegate",
     effect: "__tachyonEffect",
     elementAt: "__tachyonElementAt",
@@ -333,8 +334,8 @@ export const generateClientModule = (template, options = {}) => {
             ? `import { mountConditional as ${runtimeNames.mountConditional}, nodeAt as ${runtimeNames.nodeAt} } from "tachyon-dom/runtime/conditional";`
             : `import { mountConditional as ${runtimeNames.mountConditional} } from "tachyon-dom/runtime/conditional";`);
     }
-    if (needsSignal) {
-        lines.push(`import { effect as ${runtimeNames.effect}, read as ${runtimeNames.read} } from "tachyon-dom/runtime/signal";`);
+    if (needsSignal || hasDefaultScope) {
+        lines.push(`import { ${hasDefaultScope ? `createRoot as ${runtimeNames.createRoot}, ` : ""}${needsSignal ? `effect as ${runtimeNames.effect}, read as ${runtimeNames.read}` : ""} } from "tachyon-dom/runtime/signal";`);
     }
     if (needsStore) {
         lines.push(`import { createStore as ${runtimeNames.createStore} } from "tachyon-dom/runtime/store";`);
@@ -348,7 +349,9 @@ export const generateClientModule = (template, options = {}) => {
         lines.push(`  return localScope && typeof localScope === "object" ? { ...localScope, ...inputScope } : inputScope;`);
         lines.push(`};`);
     }
-    lines.push(hasDefaultScope ? `export const bind = (root, inputScope = {}) => {` : `export const bind = (root, scope) => {`);
+    lines.push(hasDefaultScope
+        ? `export const bind = (root, inputScope = {}) => ${runtimeNames.createRoot}((__tachyonDisposeRoot) => {`
+        : `export const bind = (root, scope) => {`);
     if (hasDefaultScope) {
         lines.push(`  const scope = __tachyonCreateScope(inputScope);`);
     }
@@ -358,7 +361,7 @@ export const generateClientModule = (template, options = {}) => {
             .join(", ");
         lines.push(`  const state = ${runtimeNames.createStore}({ ...scope, ${fields} });`);
     }
-    if (reactive || needsEvent || needsModel) {
+    if (reactive || needsEvent || needsModel || hasDefaultScope) {
         lines.push(`  const cleanups = [];`);
     }
     let listIndex = 0;
@@ -438,12 +441,26 @@ export const generateClientModule = (template, options = {}) => {
             lines.push(emitConditionalBinding(binding, reactive, sourceName, conditionalIndex++, targetName));
         }
     }
-    if (reactive || needsEvent || needsModel) {
+    if (reactive || needsEvent || needsModel || hasDefaultScope) {
         lines.push(`  return () => {`);
-        lines.push(`    for (const cleanup of cleanups) cleanup();`);
+        lines.push(`    let __tachyonCleanupError;`);
+        lines.push(`    let __tachyonCleanupFailed = false;`);
+        lines.push(`    for (const cleanup of cleanups) {`);
+        lines.push(`      try { cleanup(); } catch (error) {`);
+        lines.push(`        if (!__tachyonCleanupFailed) __tachyonCleanupError = error;`);
+        lines.push(`        __tachyonCleanupFailed = true;`);
+        lines.push(`      }`);
+        lines.push(`    }`);
+        if (hasDefaultScope) {
+            lines.push(`    try { __tachyonDisposeRoot(); } catch (error) {`);
+            lines.push(`      if (!__tachyonCleanupFailed) __tachyonCleanupError = error;`);
+            lines.push(`      __tachyonCleanupFailed = true;`);
+            lines.push(`    }`);
+        }
+        lines.push(`    if (__tachyonCleanupFailed) throw __tachyonCleanupError;`);
         lines.push(`  };`);
     }
-    lines.push(`};`);
+    lines.push(hasDefaultScope ? `});` : `};`);
     const code = `${lines.join("\n")}\n`;
     const nextCache = cachedByOptions ?? new Map();
     nextCache.set(cacheKey, code);

package/dist/compiler.d.ts

@@ -1 +1,2 @@
 export * from "./compiler/index.js";
+export { compileTachyonSfc } from "./compiler/sfc.js";

package/dist/compiler.js

@@ -1 +1,2 @@
 export * from "./compiler/index.js";
+export { compileTachyonSfc } from "./compiler/sfc.js";

package/dist/index.d.ts

@@ -1,19 +1,12 @@
 import { err, ok } from "./result.js";
-export * from "./app.js";
-export { compileTachyonSfc } from "./compiler/sfc.js";
-export { createI18n, localeMiddleware } from "./i18n.js";
-export { generateClientModule, generateServerStreamModule, renderServerTemplate } from "./compiler/index.js";
 export { enhanceForm, validateFormData } from "./runtime/form.js";
 export { cleanupEnhancements, createEnhancementRegistry, enhance, registerEnhancement } from "./runtime/enhancement.js";
 export { createClientRouter } from "./runtime/router.js";
 export { createErrorBoundary } from "./runtime/error-boundary.js";
 export { createKeyedRows } from "./runtime/keyed-rows.js";
-export { batch, catchError, createMemo, createResource, createSignal, effect, untrack } from "./runtime/signal.js";
+export { batch, catchError, createMemo, createResource, createRoot, createSignal, effect, onCleanup, untrack, } from "./runtime/signal.js";
 export { createStore } from "./runtime/store.js";
 export { readTextStreamChunks } from "./runtime/stream-client.js";
-export { attr, booleanAttr, classList, html as serverHtml, join, rawHtml } from "./server/html.js";
-export { formAction, formField, formState, preserveFormValues, redirectResponse } from "./server/form-action.js";
-export { renderToReadableStream } from "./server/stream.js";
 export { err, ok };
 export { textAt } from "./runtime/text.js";
 export type { KeyedRows, KeyedRowsOptions } from "./runtime/keyed-rows.js";

package/dist/index.js

@@ -1,18 +1,11 @@
 import { err, ok } from "./result.js";
-export * from "./app.js";
-export { compileTachyonSfc } from "./compiler/sfc.js";
-export { createI18n, localeMiddleware } from "./i18n.js";
-export { generateClientModule, generateServerStreamModule, renderServerTemplate } from "./compiler/index.js";
 export { enhanceForm, validateFormData } from "./runtime/form.js";
 export { cleanupEnhancements, createEnhancementRegistry, enhance, registerEnhancement } from "./runtime/enhancement.js";
 export { createClientRouter } from "./runtime/router.js";
 export { createErrorBoundary } from "./runtime/error-boundary.js";
 export { createKeyedRows } from "./runtime/keyed-rows.js";
-export { batch, catchError, createMemo, createResource, createSignal, effect, untrack } from "./runtime/signal.js";
+export { batch, catchError, createMemo, createResource, createRoot, createSignal, effect, onCleanup, untrack, } from "./runtime/signal.js";
 export { createStore } from "./runtime/store.js";
 export { readTextStreamChunks } from "./runtime/stream-client.js";
-export { attr, booleanAttr, classList, html as serverHtml, join, rawHtml } from "./server/html.js";
-export { formAction, formField, formState, preserveFormValues, redirectResponse } from "./server/form-action.js";
-export { renderToReadableStream } from "./server/stream.js";
 export { err, ok };
 export { textAt } from "./runtime/text.js";

package/dist/runtime/conditional.js

@@ -1,9 +1,9 @@
-import { elementAt, setClassPresence } from "./class.js";
+import { setClassPresence } from "./class.js";
 import { setAttributeValue, setRef, setStyleValue } from "./attr.js";
 import { delegate } from "./event.js";
 import { bindControl, setControlValue } from "./form.js";
 import { mountKeyedList } from "./list.js";
-import { setText, textAt } from "./text.js";
+import { setText } from "./text.js";
 const states = new WeakMap();
 export const nodeAt = (root, path) => {
     let current = root;
@@ -60,6 +60,12 @@ const createNodes = (templateHtml) => {
     template.innerHTML = templateHtml;
     return Array.from(template.content.childNodes).map((node) => node.cloneNode(true));
 };
+const nodeAtState = (state, path) => {
+    if (state.nodes.length <= 1)
+        return nodeAt(state.nodes[0], path);
+    const [firstIndex, ...rest] = path;
+    return nodeAt(state.nodes[firstIndex ?? 0], rest);
+};
 const bindNodes = (anchor, state, scope, options) => {
     state.scope = scope;
     const firstElement = state.nodes.find((node) => node instanceof Element);
@@ -68,43 +74,49 @@ const bindNodes = (anchor, state, scope, options) => {
     }
     for (const binding of options.bindings) {
         if (binding.kind === "text") {
-            setText(textAt(firstElement, binding.path), readBinding(scope, binding));
+            setText(nodeAtState(state, binding.path), readBinding(scope, binding));
         }
         else if (binding.kind === "class") {
-            setClassPresence(elementAt(firstElement, binding.path), binding.className, readBinding(scope, binding));
+            setClassPresence(nodeAtState(state, binding.path), binding.className, readBinding(scope, binding));
         }
         else if (binding.kind === "attr") {
-            setAttributeValue(elementAt(firstElement, binding.path), binding.name, readBinding(scope, binding));
+            setAttributeValue(nodeAtState(state, binding.path), binding.name, readBinding(scope, binding));
         }
         else if (binding.kind === "style") {
-            setStyleValue(elementAt(firstElement, binding.path), binding.name, readBinding(scope, binding));
+            setStyleValue(nodeAtState(state, binding.path), binding.name, readBinding(scope, binding));
         }
         else if (binding.kind === "ref") {
-            setRef(scope, binding.expression, elementAt(firstElement, binding.path));
+            setRef(scope, binding.expression, nodeAtState(state, binding.path));
         }
         else if (binding.kind === "model") {
-            setControlValue(elementAt(firstElement, binding.path), binding.property, readBinding(scope, binding));
+            setControlValue(nodeAtState(state, binding.path), binding.property, readBinding(scope, binding));
         }
         else if (binding.kind === "list") {
-            mountKeyedList(firstElement, binding.path, readExpression(scope, binding.each, binding.read), { ...binding, scope });
+            const container = nodeAtState(state, binding.path);
+            if (!(container instanceof Element))
+                continue;
+            mountKeyedList(container, [], readExpression(scope, binding.each, binding.read), { ...binding, scope });
         }
         else if (binding.kind === "if") {
-            mountConditional(firstElement, binding.path, readExpression(scope, binding.test, binding.read), scope, binding);
+            mountConditional(nodeAtState(state, binding.path), [], readExpression(scope, binding.test, binding.read), scope, binding);
         }
     }
     if (state.cleanups.length === 0) {
         for (const binding of options.bindings) {
             if (binding.kind === "event") {
+                const target = nodeAtState(state, binding.path);
+                if (!(target instanceof Element))
+                    continue;
                 const listener = (event) => {
                     const handler = readEvent(state.scope, binding);
                     if (typeof handler === "function") {
                         handler(event);
                     }
                 };
-                state.cleanups.push(delegate(firstElement, binding.eventName, binding.path, listener));
+                state.cleanups.push(delegate(target, binding.eventName, [], listener));
             }
             else if (binding.kind === "model") {
-                const element = elementAt(firstElement, binding.path);
+                const element = nodeAtState(state, binding.path);
                 state.cleanups.push(bindControl(element, binding.property, () => readBinding(scope, binding), (value) => writeBinding(scope, binding, value)));
             }
         }

package/dist/runtime/list.js

@@ -171,12 +171,15 @@ const applyRowBinding = (record, scope, options, binding, index) => {
     else if (binding.kind === "list") {
         const eachBinding = binding.read ? { expression: binding.each, read: binding.read } : { expression: binding.each };
         const value = readBinding(scope, eachBinding);
-        mountKeyedList(record.element, binding.path, value, { ...binding, scope });
+        const container = nodeAtRecord(record, binding.path);
+        if (container instanceof Element) {
+            mountKeyedList(container, [], value, { ...binding, scope });
+        }
     }
     else if (binding.kind === "if") {
         const testBinding = binding.read ? { expression: binding.test, read: binding.read } : { expression: binding.test };
         const value = readBinding(scope, testBinding);
-        mountConditional(record.element, binding.path, value, scope, binding);
+        mountConditional(nodeAtRecord(record, binding.path), [], value, scope, binding);
     }
 };
 const bindRowBindings = (record, options) => {

package/dist/runtime/signal.d.ts

@@ -1,4 +1,6 @@
 declare const signalBrand: unique symbol;
+export declare const onCleanup: (cleanup: () => void) => void;
+export declare const createRoot: <T>(fn: (dispose: () => void) => T) => T;
 export type Accessor<T> = (() => T) & {
     readonly [signalBrand]: true;
 };

package/dist/runtime/signal.js

@@ -1,9 +1,52 @@
 const signalBrand = Symbol("tachyon.signal");
 let activeEffect;
+let currentOwner;
 let batchDepth = 0;
 let flushing = false;
 const pendingComputedEffects = new Set();
 const pendingEffects = new Set();
+export const onCleanup = (cleanup) => {
+    if (currentOwner && !currentOwner.disposed) {
+        currentOwner.cleanups.push(cleanup);
+    }
+};
+export const createRoot = (fn) => {
+    const parent = currentOwner;
+    const owner = { disposed: false, cleanups: [] };
+    const dispose = () => {
+        if (owner.disposed)
+            return;
+        owner.disposed = true;
+        let firstError;
+        let failed = false;
+        for (let index = owner.cleanups.length - 1; index >= 0; index--) {
+            try {
+                owner.cleanups[index]?.();
+            }
+            catch (error) {
+                if (!failed)
+                    firstError = error;
+                failed = true;
+            }
+        }
+        owner.cleanups.length = 0;
+        if (failed)
+            throw firstError;
+    };
+    if (parent && !parent.disposed)
+        parent.cleanups.push(dispose);
+    currentOwner = owner;
+    try {
+        return fn(dispose);
+    }
+    catch (error) {
+        dispose();
+        throw error;
+    }
+    finally {
+        currentOwner = parent;
+    }
+};
 const cleanup = (runner) => {
     for (const child of Array.from(runner.children)) {
         disposeRunner(child);
@@ -182,7 +225,9 @@ const createEffect = (fn, computed) => {
     };
     parent?.children.add(runner);
     runner.run();
-    return () => disposeRunner(runner);
+    const dispose = () => disposeRunner(runner);
+    onCleanup(dispose);
+    return dispose;
 };
 export const effect = (fn) => createEffect(fn, false);
 export const catchError = (fn, onError) => effect(() => {
@@ -255,7 +300,7 @@ export const createResource = (source, fetcher) => {
     else {
         void run();
     }
-    return {
+    const resource = {
         data,
         error,
         loading,
@@ -272,4 +317,6 @@ export const createResource = (source, fetcher) => {
             loading.set(false);
         },
     };
+    onCleanup(resource.dispose);
+    return resource;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tachyon-dom",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "description": "A small TypeScript UI runtime and HTML-first compiler.",
   "keywords": [
@@ -205,6 +205,7 @@
     "bench:html-minification": "tsx benchmark/html-minification.ts",
     "bench:local:stable": "tsx benchmark/local-compare/run-local-compare.ts --iterations 30 --warmup 5",
     "bench:local:trace": "tsx benchmark/local-compare/run-local-compare.ts --serve-mode dev --iterations 1 --warmup 1 --trace-implementation tachyon-dom --trace-scenario partialUpdate",
+    "bench:summary": "tsx benchmark/summary/cli.ts",
     "bench:web-framework": "tsx benchmark/web-framework/run-web-framework-benchmark.ts",
     "bench:web-framework:smoke": "tsx benchmark/web-framework/run-web-framework-benchmark.ts --smoke",
     "example:router": "tsx examples/router.ts",
@@ -219,6 +220,8 @@
     "build:create-package": "pnpm --dir packages/create-tachyon-dom build",
     "check:exports": "publint --strict && attw --pack --no-emoji --profile esm-only",
     "check:size": "size-limit",
+    "check:browser-entry": "node scripts/verify-browser-entry.mjs",
+    "check:quick-example-size": "node scripts/verify-quick-example-bundle.mjs",
     "verify:package": "node scripts/verify-package-artifacts.mjs",
     "verify:release": "node scripts/release-contract.mjs --verify-artifacts release-artifacts",
     "prepare:release": "node scripts/release-contract.mjs",