sibujs 3.1.0 → 3.2.0

package/dist/ssr.cjs

@@ -38,6 +38,7 @@ __export(ssr_exports, {
   hydrate: () => hydrate,
   hydrateIslands: () => hydrateIslands,
   hydrateProgressively: () => hydrateProgressively,
+  isDangerousMetaRefresh: () => isDangerousMetaRefresh,
   isWasmCached: () => isWasmCached,
   island: () => island,
   loadRemoteModule: () => loadRemoteModule,
@@ -83,11 +84,15 @@ function devWarn(message) {
 var als = null;
 try {
   if (typeof process !== "undefined" && process.versions && process.versions.node) {
-    const req = Function("return typeof require==='function'?require:null")();
-    if (req) {
-      const mod = req("node:async_hooks");
-      als = new mod.AsyncLocalStorage();
+    let mod = null;
+    const getBuiltin = process.getBuiltinModule;
+    if (typeof getBuiltin === "function") {
+      mod = getBuiltin("node:async_hooks");
+    } else {
+      const req = Function("return typeof require==='function'?require:null")();
+      if (req) mod = req("node:async_hooks");
     }
+    if (mod) als = new mod.AsyncLocalStorage();
   }
 } catch {
   als = null;
@@ -105,9 +110,17 @@ function isSSR() {
 }
 
 // src/utils/sanitize.ts
+function stripControlChars(value) {
+  return value.replace(/[\x00-\x20\x7f-\x9f]+/g, "");
+}
+function isEventHandlerAttr(name) {
+  if (name.length < 3) return false;
+  const lower = name.toLowerCase();
+  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
+}
 var SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:", "ftp:"];
 function sanitizeUrl(url) {
-  const trimmed = url.replace(/[\x00-\x20\x7f-\x9f]+/g, "").trim();
+  const trimmed = stripControlChars(url).trim();
   if (!trimmed) return "";
   const lower = trimmed.toLowerCase();
   let schemeEnd = -1;
@@ -170,20 +183,18 @@ var URL_ATTRIBUTES = /* @__PURE__ */ new Set([
   "data"
 ]);
 function isUrlAttribute(attr) {
-  return URL_ATTRIBUTES.has(attr);
+  return URL_ATTRIBUTES.has(attr.toLowerCase());
 }
 
 // src/platform/ssr.ts
+function sanitizeUrlAttr(name, value) {
+  return name === "srcset" ? sanitizeSrcset(value) : sanitizeUrl(value);
+}
 var _isDev2 = isDev();
 var SAFE_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
 function isSafeAttrName(name) {
   return SAFE_ATTR_NAME.test(name);
 }
-function isEventHandlerAttr(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 var URL_ATTRS = /* @__PURE__ */ new Set([
   "href",
   "src",
@@ -258,7 +269,7 @@ function renderToString(element) {
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
     if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerName, value);
       if (!value) continue;
     }
     html2 += ` ${rawName}="${escapeAttr(value)}"`;
@@ -399,7 +410,7 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
     const lowerKey = rawKey.toLowerCase();
     let value = String(attrs[rawKey]);
     if (URL_ATTRS.has(lowerKey)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerKey, value);
       if (!value) continue;
     }
     out.push(`${rawKey}="${escapeAttr(value)}"`);
@@ -407,12 +418,17 @@ function buildAttrString(attrs, { allowEventHandlers = false } = {}) {
   return out.join(" ");
 }
 function isDangerousMetaRefresh(metaProps) {
-  const httpEquiv = metaProps["http-equiv"];
+  let httpEquiv;
+  let content;
+  for (const k in metaProps) {
+    const lk = k.toLowerCase();
+    if (lk === "http-equiv") httpEquiv = metaProps[k];
+    else if (lk === "content") content = metaProps[k];
+  }
   if (typeof httpEquiv !== "string") return false;
   if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = metaProps.content;
   if (typeof content !== "string") return false;
-  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
+  const normalized = stripControlChars(content).toLowerCase();
   return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
 }
 function renderToDocument(component, options = {}) {
@@ -494,7 +510,7 @@ async function* renderToStream(element) {
     const lowerName = rawName.toLowerCase();
     let value = attr.value;
     if (URL_ATTRS.has(lowerName)) {
-      value = sanitizeUrl(value);
+      value = sanitizeUrlAttr(lowerName, value);
       if (!value) continue;
     }
     openTag += ` ${rawName}="${escapeAttr(value)}"`;
@@ -571,11 +587,11 @@ function hydrateProgressively(container, islands, options) {
       (entries) => {
         for (const entry of entries) {
           if (entry.isIntersecting) {
+            observer.disconnect();
             const clientTree = factory();
             clientTree.setAttribute("data-sibu-island", id);
             clientTree.setAttribute("data-sibu-hydrated", "true");
             marker2.replaceWith(clientTree);
-            observer.disconnect();
             break;
           }
         }
@@ -829,7 +845,7 @@ function track(effectFn, subscriber) {
 function reactiveBinding(commit) {
   const run = () => {
     const s2 = subscriber;
-    if (s2._reentrant) return;
+    if (s2._disposed || s2._reentrant) return;
     s2._reentrant = true;
     try {
       retrack(commit, subscriber);
@@ -845,8 +861,12 @@ function reactiveBinding(commit) {
   subscriber._runEpoch = 0;
   subscriber._runs = 0;
   subscriber._reentrant = false;
+  subscriber._disposed = false;
   run();
-  return subscriber._dispose ?? (subscriber._dispose = () => cleanup(subscriber));
+  return subscriber._dispose ?? (subscriber._dispose = () => {
+    subscriber._disposed = true;
+    cleanup(subscriber);
+  });
 }
 function recordDependency(signal2) {
   if (!currentSubscriber) return;
@@ -1114,6 +1134,7 @@ function effect(effectFn, options) {
     ctx.fn(ctx.onCleanup);
   };
   const sub2 = (() => {
+    if (ctx.disposed) return;
     if (ctx.running) {
       ctx.rerunPending = true;
       return;
@@ -1155,24 +1176,28 @@ function sanitizeHeadAttr(key, value) {
   if (HEAD_URL_ATTRS.has(key)) return sanitizeUrl(value);
   return value;
 }
+function isDangerousRefreshContent(content) {
+  const normalized = stripControlChars(content).toLowerCase();
+  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+}
+function getMetaAttr(metaProps, name) {
+  for (const k in metaProps) {
+    if (k.toLowerCase() === name) return metaProps[k];
+  }
+  return void 0;
+}
 function isDangerousMetaRefresh2(metaProps) {
-  const httpEquiv = metaProps["http-equiv"];
+  const httpEquiv = getMetaAttr(metaProps, "http-equiv");
   if (typeof httpEquiv !== "string") return false;
   if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = metaProps.content;
+  const content = getMetaAttr(metaProps, "content");
   if (typeof content !== "string") return false;
-  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+  return isDangerousRefreshContent(content);
 }
 var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
-function isEventHandlerAttr2(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 function isSafeHeadAttr(name) {
   if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
-  if (isEventHandlerAttr2(name)) return false;
+  if (isEventHandlerAttr(name)) return false;
   return true;
 }
 function escapeScriptJsonLocal(json) {
@@ -1205,15 +1230,27 @@ function Head(props) {
     if (props.meta) {
       for (const metaProps of props.meta) {
         if (isDangerousMetaRefresh2(metaProps)) continue;
+        const httpEquiv = getMetaAttr(metaProps, "http-equiv");
+        const isRefreshNow = () => {
+          const eq = typeof httpEquiv === "function" ? httpEquiv() : httpEquiv;
+          return typeof eq === "string" && eq.toLowerCase() === "refresh";
+        };
         const el = document.createElement("meta");
         for (const [key, value] of Object.entries(metaProps)) {
           if (!isSafeHeadAttr(key)) continue;
+          const isContent = key.toLowerCase() === "content";
           if (typeof value === "function") {
             const cleanupFn = effect(() => {
-              el.setAttribute(key, sanitizeHeadAttr(key, value()));
+              const resolved = value();
+              if (isContent && isRefreshNow() && isDangerousRefreshContent(resolved)) {
+                el.removeAttribute(key);
+                return;
+              }
+              el.setAttribute(key, sanitizeHeadAttr(key, resolved));
             });
             effectCleanups.push(cleanupFn);
           } else {
+            if (isContent && isRefreshNow() && isDangerousRefreshContent(value)) continue;
             el.setAttribute(key, sanitizeHeadAttr(key, value));
           }
         }
@@ -1433,13 +1470,13 @@ function createISR(options) {
       if (typeof console !== "undefined") console.warn("[SibuJS ISR] revalidate failed", err);
     });
   }, revalidateAfter);
-  const dispose = () => {
+  const dispose2 = () => {
     if (disposed) return;
     disposed = true;
     clearInterval(intervalId);
     controller.abort();
   };
-  return { data: data2, isStale, revalidate, dispose };
+  return { data: data2, isStale, revalidate, dispose: dispose2 };
 }
 
 // src/platform/routeActions.ts
@@ -1502,14 +1539,14 @@ function scrollRestoration(options) {
     };
     window.addEventListener("popstate", popstateHandler);
   }
-  const dispose = () => {
+  const dispose2 = () => {
     if (popstateHandler) {
       window.removeEventListener("popstate", popstateHandler);
       popstateHandler = null;
     }
     positions.clear();
   };
-  return { save, restore, getPosition, dispose };
+  return { save, restore, getPosition, dispose: dispose2 };
 }
 
 // src/platform/routeMiddleware.ts
@@ -1548,13 +1585,8 @@ var _isDev5 = isDev();
 function setProp(el, key, val) {
   el[key] = val;
 }
-function isEventHandlerAttr3(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 function bindAttribute(el, attr, getter) {
-  if (isEventHandlerAttr3(attr)) {
+  if (isEventHandlerAttr(attr)) {
     if (_isDev5)
       devWarn(
         `bindAttribute: refusing to bind event-handler attribute "${attr}". Use on:{ ${attr.slice(2)}: fn } instead.`
@@ -1591,8 +1623,69 @@ function bindAttribute(el, attr, getter) {
   return reactiveBinding(commit);
 }
 
-// src/reactivity/bindChildNode.ts
+// src/core/rendering/dispose.ts
+var elementDisposers = /* @__PURE__ */ new WeakMap();
 var _isDev6 = isDev();
+var activeBindingCount = 0;
+function registerDisposer(node, teardown) {
+  let disposers = elementDisposers.get(node);
+  if (!disposers) {
+    disposers = [];
+    elementDisposers.set(node, disposers);
+  }
+  disposers.push(teardown);
+  if (_isDev6) activeBindingCount++;
+}
+function dispose(node) {
+  const stack = [node];
+  const order = [];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    order.push(current);
+    const children = Array.from(current.childNodes);
+    for (let i2 = 0; i2 < children.length; i2++) {
+      stack.push(children[i2]);
+    }
+  }
+  for (let i2 = order.length - 1; i2 >= 0; i2--) {
+    const current = order[i2];
+    const disposers = elementDisposers.get(current);
+    if (disposers) {
+      const snapshot = disposers.slice();
+      elementDisposers.delete(current);
+      if (_isDev6) activeBindingCount -= snapshot.length;
+      for (const d of snapshot) {
+        try {
+          d();
+        } catch (err) {
+          if (_isDev6 && typeof console !== "undefined") {
+            console.warn("[SibuJS] Disposer threw during cleanup:", err);
+          }
+        }
+      }
+      let extraPasses = 0;
+      while (extraPasses++ < 8) {
+        const added = elementDisposers.get(current);
+        if (!added || added.length === 0) break;
+        const moreSnapshot = added.slice();
+        elementDisposers.delete(current);
+        if (_isDev6) activeBindingCount -= moreSnapshot.length;
+        for (const d of moreSnapshot) {
+          try {
+            d();
+          } catch (err) {
+            if (_isDev6 && typeof console !== "undefined") {
+              console.warn("[SibuJS] Disposer threw during cleanup:", err);
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+// src/reactivity/bindChildNode.ts
+var _isDev7 = isDev();
 function bindChildNode(placeholder, getter) {
   let lastNodes = [];
   function commit() {
@@ -1600,12 +1693,13 @@ function bindChildNode(placeholder, getter) {
     try {
       result = getter();
     } catch (err) {
-      if (_isDev6) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
+      if (_isDev7) devWarn(`bindChildNode: getter threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
     if (result == null || typeof result === "boolean") {
       for (let i2 = 0; i2 < lastNodes.length; i2++) {
         const node = lastNodes[i2];
+        dispose(node);
         if (node.parentNode) node.parentNode.removeChild(node);
       }
       lastNodes.length = 0;
@@ -1625,7 +1719,7 @@ function bindChildNode(placeholder, getter) {
         if (item == null || typeof item === "boolean") continue;
         const node = item instanceof Node ? item : document.createTextNode(String(item));
         if (seen.has(node)) {
-          if (_isDev6)
+          if (_isDev7)
             devWarn("bindChildNode: duplicate node reference in array \u2014 only the first occurrence is rendered.");
           continue;
         }
@@ -1647,38 +1741,22 @@ function bindChildNode(placeholder, getter) {
     for (let i2 = 0; i2 < lastNodes.length; i2++) {
       const node = lastNodes[i2];
       if (reused?.has(node)) continue;
+      dispose(node);
       if (node.parentNode) node.parentNode.removeChild(node);
     }
-    const anchor = placeholder.nextSibling;
+    let prev = placeholder;
     for (let i2 = 0; i2 < newNodes.length; i2++) {
       const node = newNodes[i2];
-      if (reused?.has(node) && node.parentNode === parent) {
-        if (node.nextSibling !== anchor) {
-          parent.insertBefore(node, anchor);
-        }
-      } else {
-        parent.insertBefore(node, anchor);
+      if (prev.nextSibling !== node) {
+        parent.insertBefore(node, prev.nextSibling);
       }
+      prev = node;
     }
     lastNodes = newNodes;
   }
   return reactiveBinding(commit);
 }
 
-// src/core/rendering/dispose.ts
-var elementDisposers = /* @__PURE__ */ new WeakMap();
-var _isDev7 = isDev();
-var activeBindingCount = 0;
-function registerDisposer(node, teardown) {
-  let disposers = elementDisposers.get(node);
-  if (!disposers) {
-    disposers = [];
-    elementDisposers.set(node, disposers);
-  }
-  disposers.push(teardown);
-  if (_isDev7) activeBindingCount++;
-}
-
 // src/core/rendering/tagFactory.ts
 var SVG_NS = "http://www.w3.org/2000/svg";
 var _isDev8 = isDev();
@@ -1914,7 +1992,7 @@ var tagFactory = (tag, ns) => {
           const value = props[key];
           if (value == null) continue;
           const lkey = key.toLowerCase();
-          if (lkey[0] === "o" && lkey[1] === "n") continue;
+          if (isEventHandlerAttr(key)) continue;
           if (typeof value === "function") {
             registerDisposer(el, bindAttribute(el, key, value));
           } else if (typeof value === "boolean") {
@@ -2681,6 +2759,7 @@ function isWasmCached(key) {
   hydrate,
   hydrateIslands,
   hydrateProgressively,
+  isDangerousMetaRefresh,
   isWasmCached,
   island,
   loadRemoteModule,

package/dist/ssr.d.cts

@@ -1,4 +1,4 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-CrVNy6Pa.cjs';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-D62yFwuw.cjs';
 
 interface HeadProps {
     title?: string | (() => string);

package/dist/ssr.d.ts

@@ -1,4 +1,4 @@
-export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as island, r as renderToDocument, g as renderToReadableStream, j as renderToStream, k as renderToString, l as renderToSuspenseStream, m as resetSSRState, s as serializeState, n as ssrSuspense, o as suspenseSwapScript, t as trustHTML } from './ssr-CrVNy6Pa.js';
+export { H as HydrateOptions, a as HydrationMismatch, T as TrustedHTML, c as collectStream, d as deserializeState, e as escapeScriptJson, h as hydrate, b as hydrateIslands, f as hydrateProgressively, i as isDangerousMetaRefresh, g as island, r as renderToDocument, j as renderToReadableStream, k as renderToStream, l as renderToString, m as renderToSuspenseStream, n as resetSSRState, s as serializeState, o as ssrSuspense, p as suspenseSwapScript, t as trustHTML } from './ssr-D62yFwuw.js';
 
 interface HeadProps {
     title?: string | (() => string);

package/dist/ssr.js

@@ -22,8 +22,8 @@ import {
   wasm,
   worker,
   workerFn
-} from "./chunk-UYX2NDOH.js";
-import "./chunk-2HAGQWDV.js";
+} from "./chunk-OYLPZO4N.js";
+import "./chunk-5N74TKLD.js";
 import {
   collectStream,
   deserializeState,
@@ -31,6 +31,7 @@ import {
   hydrate,
   hydrateIslands,
   hydrateProgressively,
+  isDangerousMetaRefresh,
   island,
   renderToDocument,
   renderToReadableStream,
@@ -42,15 +43,15 @@ import {
   ssrSuspense,
   suspenseSwapScript,
   trustHTML
-} from "./chunk-JYD2PWXH.js";
-import "./chunk-WKUXSE7V.js";
-import "./chunk-2ZJ7TSW4.js";
+} from "./chunk-HXMS4SNP.js";
+import "./chunk-X67UYC74.js";
+import "./chunk-RLUJL2MV.js";
 import "./chunk-2UPRY23K.js";
-import "./chunk-UCS6AMJ7.js";
-import "./chunk-ZIBE2SAT.js";
-import "./chunk-2RA7SHDA.js";
-import "./chunk-RK4BQG25.js";
-import "./chunk-3U4ZVXVD.js";
+import "./chunk-HMJFCBRR.js";
+import "./chunk-FDY42FIU.js";
+import "./chunk-GOJMFRBL.js";
+import "./chunk-C427DVQF.js";
+import "./chunk-Z2FWAE4B.js";
 import "./chunk-LMLD24FC.js";
 export {
   Head,
@@ -71,6 +72,7 @@ export {
   hydrate,
   hydrateIslands,
   hydrateProgressively,
+  isDangerousMetaRefresh,
   isWasmCached,
   island,
   loadRemoteModule,

package/dist/testing.cjs

@@ -1637,11 +1637,15 @@ function cleanup(subscriber) {
 var als = null;
 try {
   if (typeof process !== "undefined" && process.versions && process.versions.node) {
-    const req = Function("return typeof require==='function'?require:null")();
-    if (req) {
-      const mod = req("node:async_hooks");
-      als = new mod.AsyncLocalStorage();
+    let mod = null;
+    const getBuiltin = process.getBuiltinModule;
+    if (typeof getBuiltin === "function") {
+      mod = getBuiltin("node:async_hooks");
+    } else {
+      const req = Function("return typeof require==='function'?require:null")();
+      if (req) mod = req("node:async_hooks");
     }
+    if (mod) als = new mod.AsyncLocalStorage();
   }
 } catch {
   als = null;
@@ -1743,6 +1747,7 @@ function effect(effectFn, options) {
     ctx.fn(ctx.onCleanup);
   };
   const sub = (() => {
+    if (ctx.disposed) return;
     if (ctx.running) {
       ctx.rerunPending = true;
       return;

package/dist/testing.js

@@ -3,9 +3,9 @@ import {
 } from "./chunk-2UPRY23K.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
-import "./chunk-2RA7SHDA.js";
-import "./chunk-3U4ZVXVD.js";
+} from "./chunk-FDY42FIU.js";
+import "./chunk-GOJMFRBL.js";
+import "./chunk-Z2FWAE4B.js";
 import "./chunk-LMLD24FC.js";
 
 // src/testing/a11y.ts