sibujs 3.1.0 → 3.2.0

package/dist/{chunk-QNQY5DUS.js → chunk-NPIEEKPT.js}

@@ -1,22 +1,22 @@
 import {
   bindAttribute
-} from "./chunk-2ZJ7TSW4.js";
+} from "./chunk-RLUJL2MV.js";
 import {
   derived
-} from "./chunk-SC437AMI.js";
+} from "./chunk-JYXOEYI4.js";
 import {
   dispose,
   registerDisposer
 } from "./chunk-2UPRY23K.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 import {
   track
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 
 // src/ui/form.ts
 function required(message = "This field is required") {
@@ -245,7 +245,10 @@ function VirtualList(props) {
     const visibleCount = Math.ceil(props.containerHeight / props.itemHeight) + 2 * overscan;
     const endIndex = Math.min(items.length, startIndex + visibleCount);
     content.style.top = `${startIndex * props.itemHeight}px`;
-    content.innerHTML = "";
+    while (content.firstChild) {
+      dispose(content.firstChild);
+      content.removeChild(content.firstChild);
+    }
     for (let i = startIndex; i < endIndex; i++) {
       const itemEl = props.renderItem(items[i], i);
       itemEl.style.height = `${props.itemHeight}px`;
@@ -253,7 +256,7 @@ function VirtualList(props) {
       content.appendChild(itemEl);
     }
   };
-  effect(update);
+  registerDisposer(container, effect(update));
   return container;
 }
 
@@ -394,7 +397,10 @@ function inputMask(options) {
           }
         }
       }
-      input.setSelectionRange(newCursor, newCursor);
+      try {
+        input.setSelectionRange(newCursor, newCursor);
+      } catch {
+      }
     };
     const onFocus = () => {
       if (!input.value) {
@@ -436,9 +442,12 @@ function aria(element, attrs) {
     const ariaKey = key.startsWith("aria-") ? key : `aria-${key}`;
     if (typeof value === "function") {
       const getter = value;
-      track(() => {
-        element.setAttribute(ariaKey, String(getter()));
-      });
+      registerDisposer(
+        element,
+        track(() => {
+          element.setAttribute(ariaKey, String(getter()));
+        })
+      );
     } else {
       element.setAttribute(ariaKey, String(value));
     }

package/dist/{chunk-UYX2NDOH.js → chunk-OYLPZO4N.js}

@@ -1,17 +1,19 @@
 import {
   div,
   span
-} from "./chunk-2HAGQWDV.js";
+} from "./chunk-5N74TKLD.js";
 import {
-  sanitizeUrl
-} from "./chunk-UCS6AMJ7.js";
+  isEventHandlerAttr,
+  sanitizeUrl,
+  stripControlChars
+} from "./chunk-HMJFCBRR.js";
 import {
   effect
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   batch,
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 
 // src/platform/head.ts
 var HEAD_URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
@@ -19,21 +21,25 @@ function sanitizeHeadAttr(key, value) {
   if (HEAD_URL_ATTRS.has(key)) return sanitizeUrl(value);
   return value;
 }
+function isDangerousRefreshContent(content) {
+  const normalized = stripControlChars(content).toLowerCase();
+  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+}
+function getMetaAttr(metaProps, name) {
+  for (const k in metaProps) {
+    if (k.toLowerCase() === name) return metaProps[k];
+  }
+  return void 0;
+}
 function isDangerousMetaRefresh(metaProps) {
-  const httpEquiv = metaProps["http-equiv"];
+  const httpEquiv = getMetaAttr(metaProps, "http-equiv");
   if (typeof httpEquiv !== "string") return false;
   if (httpEquiv.toLowerCase() !== "refresh") return false;
-  const content = metaProps.content;
+  const content = getMetaAttr(metaProps, "content");
   if (typeof content !== "string") return false;
-  const normalized = content.replace(/[\x00-\x20\x7f-\x9f]+/g, "").toLowerCase();
-  return normalized.includes("url=javascript:") || normalized.includes("url=data:") || normalized.includes("url=vbscript:") || normalized.includes("url=blob:");
+  return isDangerousRefreshContent(content);
 }
 var SAFE_HEAD_ATTR_NAME = /^[A-Za-z_:][-A-Za-z0-9_.:]*$/;
-function isEventHandlerAttr(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 function isSafeHeadAttr(name) {
   if (!SAFE_HEAD_ATTR_NAME.test(name)) return false;
   if (isEventHandlerAttr(name)) return false;
@@ -69,15 +75,27 @@ function Head(props) {
     if (props.meta) {
       for (const metaProps of props.meta) {
         if (isDangerousMetaRefresh(metaProps)) continue;
+        const httpEquiv = getMetaAttr(metaProps, "http-equiv");
+        const isRefreshNow = () => {
+          const eq = typeof httpEquiv === "function" ? httpEquiv() : httpEquiv;
+          return typeof eq === "string" && eq.toLowerCase() === "refresh";
+        };
         const el = document.createElement("meta");
         for (const [key, value] of Object.entries(metaProps)) {
           if (!isSafeHeadAttr(key)) continue;
+          const isContent = key.toLowerCase() === "content";
           if (typeof value === "function") {
             const cleanupFn = effect(() => {
-              el.setAttribute(key, sanitizeHeadAttr(key, value()));
+              const resolved = value();
+              if (isContent && isRefreshNow() && isDangerousRefreshContent(resolved)) {
+                el.removeAttribute(key);
+                return;
+              }
+              el.setAttribute(key, sanitizeHeadAttr(key, resolved));
             });
             effectCleanups.push(cleanupFn);
           } else {
+            if (isContent && isRefreshNow() && isDangerousRefreshContent(value)) continue;
             el.setAttribute(key, sanitizeHeadAttr(key, value));
           }
         }

package/dist/{chunk-LYTCUZ7H.js → chunk-RDRSWYNP.js}

@@ -1,6 +1,6 @@
 import {
   renderToString
-} from "./chunk-JYD2PWXH.js";
+} from "./chunk-HXMS4SNP.js";
 
 // src/plugins/modular.ts
 function createModuleRegistry() {

package/dist/{chunk-2ZJ7TSW4.js → chunk-RLUJL2MV.js}

@@ -1,10 +1,11 @@
 import {
+  isEventHandlerAttr,
   isUrlAttribute,
   sanitizeUrl
-} from "./chunk-UCS6AMJ7.js";
+} from "./chunk-HMJFCBRR.js";
 import {
   reactiveBinding
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   devWarn,
   isDev
@@ -15,11 +16,6 @@ var _isDev = isDev();
 function setProp(el, key, val) {
   el[key] = val;
 }
-function isEventHandlerAttr(name) {
-  if (name.length < 3) return false;
-  const lower = name.toLowerCase();
-  return lower[0] === "o" && lower[1] === "n" && lower.charCodeAt(2) >= 97 && lower.charCodeAt(2) <= 122;
-}
 function bindAttribute(el, attr, getter) {
   if (isEventHandlerAttr(attr)) {
     if (_isDev)
@@ -74,7 +70,7 @@ function bindDynamic(el, nameGetter, valueGetter) {
       if (_isDev) devWarn(`bindDynamic: value getter threw: ${err instanceof Error ? err.message : String(err)}`);
       return;
     }
-    if ((name[0] === "o" || name[0] === "O") && (name[1] === "n" || name[1] === "N")) return;
+    if (isEventHandlerAttr(name)) return;
     if (prevName !== null && prevName !== name) {
       el.removeAttribute(prevName);
     }

package/dist/{chunk-CR4MXPHB.js → chunk-V2MTG5FT.js}

@@ -139,56 +139,58 @@ import {
   use,
   var_,
   video
-} from "./chunk-2HAGQWDV.js";
+} from "./chunk-5N74TKLD.js";
 import {
   watch
-} from "./chunk-3DJH25UO.js";
+} from "./chunk-H6PCHJZQ.js";
 import {
   trustHTML
-} from "./chunk-JYD2PWXH.js";
+} from "./chunk-HXMS4SNP.js";
 import {
   context
-} from "./chunk-EFOAE5NC.js";
+} from "./chunk-YFDGQWDA.js";
 import {
   SVG_NS,
   bindChildNode,
   tagFactory
-} from "./chunk-WKUXSE7V.js";
+} from "./chunk-X67UYC74.js";
 import {
   bindAttribute,
   bindDynamic
-} from "./chunk-2ZJ7TSW4.js";
+} from "./chunk-RLUJL2MV.js";
 import {
   derived
-} from "./chunk-SC437AMI.js";
+} from "./chunk-JYXOEYI4.js";
 import {
   checkLeaks,
   dispose,
   registerDisposer
 } from "./chunk-2UPRY23K.js";
 import {
+  isEventHandlerAttr,
   isUrlAttribute,
   sanitizeSrcset,
   sanitizeUrl
-} from "./chunk-UCS6AMJ7.js";
+} from "./chunk-HMJFCBRR.js";
 import {
   effect,
   on
-} from "./chunk-ZIBE2SAT.js";
+} from "./chunk-FDY42FIU.js";
 import {
   disableSSR,
   enableSSR,
+  getRequestScopedCache,
   getSSRStore,
   isSSR,
   runInSSRContext,
   withSSR
-} from "./chunk-2RA7SHDA.js";
+} from "./chunk-GOJMFRBL.js";
 import {
   batch,
   enqueueBatchedSignal,
   isBatching,
   signal
-} from "./chunk-RK4BQG25.js";
+} from "./chunk-C427DVQF.js";
 import {
   notifySubscribers,
   recordDependency,
@@ -196,7 +198,7 @@ import {
   setMaxDrainIterations,
   track,
   untracked
-} from "./chunk-3U4ZVXVD.js";
+} from "./chunk-Z2FWAE4B.js";
 import {
   __export,
   devAssert,
@@ -286,6 +288,7 @@ __export(index_exports, {
   footer: () => footer,
   form: () => form,
   g: () => g,
+  getRequestScopedCache: () => getRequestScopedCache,
   getSSRStore: () => getSSRStore,
   getSlot: () => getSlot,
   h1: () => h1,
@@ -528,14 +531,28 @@ function parseTemplate(strings) {
       }
       return { kind: "mixed", statics, exprs };
     }
-    const valStart = pos;
-    while (pos < len) {
-      const c = template2.charCodeAt(pos);
-      if (c === 32 || c === 9 || c === 10 || c === 13 || c === 62 || c === 47) break;
-      pos++;
+    {
+      const statics = [];
+      const exprs = [];
+      let current = "";
+      while (pos < len) {
+        const c = template2.charCodeAt(pos);
+        if (c === 32 || c === 9 || c === 10 || c === 13 || c === 62) break;
+        const innerIdx = tryExprIdx();
+        if (innerIdx >= 0) {
+          statics.push(current);
+          current = "";
+          exprs.push(innerIdx);
+        } else {
+          current += template2[pos++];
+        }
+      }
+      statics.push(current);
+      if (exprs.length === 0) {
+        return { kind: "static", value: statics[0] };
+      }
+      return { kind: "mixed", statics, exprs };
     }
-    const val = template2.slice(valStart, pos);
-    return { kind: "static", value: val };
   }
   function parseAttrs() {
     const attrs = [];
@@ -592,6 +609,30 @@ function parseTemplate(strings) {
     while (pos < len) {
       if (template2[pos] === "<" && pos + 1 < len && template2[pos + 1] === "/") break;
       if (template2[pos] === "<") {
+        const next = template2[pos + 1];
+        if (next === "!") {
+          if (template2.startsWith("<!--", pos)) {
+            const end = template2.indexOf("-->", pos + 4);
+            pos = end === -1 ? len : end + 3;
+          } else if (template2.startsWith("<![CDATA[", pos)) {
+            const end = template2.indexOf("]]>", pos + 9);
+            pos = end === -1 ? len : end + 3;
+          } else {
+            const end = template2.indexOf(">", pos);
+            pos = end === -1 ? len : end + 1;
+          }
+          continue;
+        }
+        if (next === "?") {
+          const end = template2.indexOf(">", pos);
+          pos = end === -1 ? len : end + 1;
+          continue;
+        }
+        if (!(next >= "a" && next <= "z") && !(next >= "A" && next <= "Z")) {
+          children.push({ t: 1, value: "<" });
+          pos++;
+          continue;
+        }
         pos++;
         const tag = readTagName();
         const attrs = parseAttrs();
@@ -640,7 +681,7 @@ function executeElement(tmpl, values) {
       case 1: {
         const name = attr.name;
         const lname = name.toLowerCase();
-        if (lname[0] === "o" && lname[1] === "n") break;
+        if (isEventHandlerAttr(name)) break;
         const val = values[attr.idx];
         if (typeof val === "function") {
           registerDisposer(el, bindAttribute(el, name, val));
@@ -889,6 +930,11 @@ function each(getArray, render, options) {
     workMap.clear();
     keyIndexMap.clear();
     for (let i2 = 0; i2 < newLen; i2++) {
+      if (_isDev2 && keyIndexMap.has(newKeys[i2])) {
+        devWarn(
+          `each: duplicate key "${String(newKeys[i2])}" at index ${i2} (first seen at ${keyIndexMap.get(newKeys[i2])}). Keys must be unique \u2014 duplicates cause rows to be dropped or mis-ordered.`
+        );
+      }
       keyIndexMap.set(newKeys[i2], i2);
     }
     for (let i2 = 0; i2 < newLen; i2++) {
@@ -1120,7 +1166,7 @@ function show(condition, element) {
   const update = () => {
     element.style.display = condition() ? "" : "none";
   };
-  track(update);
+  registerDisposer(element, track(update));
   return element;
 }
 function when(condition, thenBranch, elseBranch) {
@@ -1147,7 +1193,7 @@ function when(condition, thenBranch, elseBranch) {
     }
     initialized = true;
   };
-  track(update);
+  registerDisposer(anchor, track(update));
   if (!initialized) {
     queueMicrotask(() => {
       if (!initialized && anchor.parentNode) update();
@@ -1182,7 +1228,7 @@ function match(value, cases, fallback) {
     }
     initialized = true;
   };
-  track(update);
+  registerDisposer(anchor, track(update));
   if (!initialized) {
     queueMicrotask(() => {
       if (!initialized && anchor.parentNode) update();
@@ -1223,6 +1269,12 @@ function KeepAlive(activeKey, cases, options) {
         return;
       }
       node = factory();
+      if (node instanceof DocumentFragment) {
+        const wrapper = document.createElement("div");
+        wrapper.style.display = "contents";
+        wrapper.appendChild(node);
+        node = wrapper;
+      }
       cache2.set(key, node);
       lruOrder.push(key);
       if (max > 0 && lruOrder.length > max) {
@@ -1402,12 +1454,12 @@ function store(initialState) {
     signals[key] = [getter, setter];
   });
   const store2 = new Proxy({}, {
-    get(_, prop) {
-      if (prop in signals) {
+    get(target, prop) {
+      if (typeof prop === "string" && Object.hasOwn(signals, prop)) {
         const getter = signals[prop][0];
         return getter();
       }
-      return void 0;
+      return Reflect.get(target, prop);
     },
     set() {
       throw new Error(
@@ -1427,7 +1479,7 @@ function store(initialState) {
     const nextState = typeof patch === "function" ? patch(current) : patch;
     batch(() => {
       Object.entries(nextState).forEach(([key, value]) => {
-        if (key in signals) {
+        if (Object.hasOwn(signals, key)) {
           signals[key][1](value);
         }
       });
@@ -1725,6 +1777,14 @@ function deepEqual(a2, b2, seen) {
     }
     return true;
   }
+  if (a2 instanceof DataView) {
+    if (!(b2 instanceof DataView)) return false;
+    if (a2.byteLength !== b2.byteLength) return false;
+    for (let i2 = 0; i2 < a2.byteLength; i2++) {
+      if (a2.getUint8(i2) !== b2.getUint8(i2)) return false;
+    }
+    return true;
+  }
   if (ArrayBuffer.isView(a2) && ArrayBuffer.isView(b2)) {
     const ta = a2;
     const tb = b2;
@@ -1743,7 +1803,7 @@ function deepEqual(a2, b2, seen) {
   const keysB = Object.keys(objB);
   if (keysA.length !== keysB.length) return false;
   return keysA.every(
-    (key) => deepEqual(objA[key], objB[key], seen)
+    (key) => Object.hasOwn(objB, key) && deepEqual(objA[key], objB[key], seen)
   );
 }
 function deepSignal(initial) {
@@ -2215,34 +2275,37 @@ function Suspense({ nodes, fallback }) {
   container.appendChild(fallbackEl);
   let suspenseDisposed = false;
   let observer = null;
+  let childEl = null;
   registerDisposer(container, () => {
     suspenseDisposed = true;
     if (observer) {
       observer.disconnect();
       observer = null;
     }
+    if (childEl && !container.contains(childEl)) dispose(childEl);
   });
   queueMicrotask(() => {
     if (suspenseDisposed) return;
     try {
-      const childEl = nodes();
-      if (childEl.classList.contains("sibu-lazy")) {
-        if (!childEl.querySelector(".sibu-lazy-loading")) {
-          container.replaceChildren(childEl);
+      const el = nodes();
+      childEl = el;
+      if (el.classList.contains("sibu-lazy")) {
+        if (!el.querySelector(".sibu-lazy-loading")) {
+          container.replaceChildren(el);
           return;
         }
         observer = new MutationObserver(() => {
           if (suspenseDisposed) return;
-          const loading = childEl.querySelector(".sibu-lazy-loading");
+          const loading = el.querySelector(".sibu-lazy-loading");
           if (!loading) {
             observer?.disconnect();
             observer = null;
-            container.replaceChildren(childEl);
+            container.replaceChildren(el);
           }
         });
-        observer.observe(childEl, { childList: true, subtree: true });
+        observer.observe(el, { childList: true, subtree: true });
       } else {
-        container.replaceChildren(childEl);
+        container.replaceChildren(el);
       }
     } catch (err) {
       const errorObj = err instanceof Error ? err : new Error(String(err));

package/dist/{chunk-CNZ35WI2.js → chunk-VJE6DDYM.js}

@@ -33,7 +33,7 @@ function withBoundary(name, component) {
 function createSlots(slots) {
   return {
     renderSlot(name, fallback) {
-      const slotFn = slots[name];
+      const slotFn = Object.hasOwn(slots, name) ? slots[name] : void 0;
       if (slotFn) {
         const result = slotFn();
         if (Array.isArray(result)) {
@@ -47,7 +47,7 @@ function createSlots(slots) {
       return fallback ? fallback() : null;
     },
     hasSlot(name) {
-      return name in slots;
+      return Object.hasOwn(slots, name);
     }
   };
 }